CVE-2024-39384: Adobe Premiere Pro RCE Vulnerability

CVE-2024-39384 Overview

CVE-2024-39384 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Premiere Pro versions 24.5, 23.6.8, and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw requires user interaction: a victim must open a malicious file crafted by an attacker.

The vulnerability affects Premiere Pro installations on both Microsoft Windows and Apple macOS. Adobe addressed the issue in security bulletin APSB24-58. The CVSS 3.1 base score is 7.8, and the EPSS score is 0.292% (21.48 percentile).

Critical Impact
An attacker who convinces a user to open a malicious project or media file can execute arbitrary code with the privileges of the Premiere Pro user.

Affected Products

Adobe Premiere Pro version 24.5 and earlier 24.x releases
Adobe Premiere Pro version 23.6.8 and earlier 23.x releases
Adobe Premiere Pro on Microsoft Windows and Apple macOS

Discovery Timeline

2024-09-13 - CVE-2024-39384 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-39384

Vulnerability Analysis

CVE-2024-39384 is an out-of-bounds write flaw in Adobe Premiere Pro's file parsing logic. When Premiere Pro processes a malformed input file, the application writes data past the boundary of an allocated buffer. This memory corruption can overwrite adjacent structures, function pointers, or return addresses.

An attacker who controls the out-of-bounds write can steer execution into attacker-supplied data. Because Premiere Pro runs as the invoked user, successful exploitation grants the attacker's payload the same access to the file system, network, and connected media as the victim account. The vulnerability does not cross privilege boundaries on its own, but pairs well with local privilege-escalation flaws.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of untrusted file content. Premiere Pro handles a wide range of container, codec, and project file formats. A specific parser in the affected versions calculates a destination offset or length from attacker-controlled fields without validating it against the target buffer size. Adobe has not published the specific parser or file format at fault in the public advisory.

Attack Vector

Exploitation requires local user interaction. The attacker delivers a malicious file, such as a project file, media asset, or preset, through email, a shared drive, a compromised website, or a supply-chain vector. When the victim opens the file in Premiere Pro, the vulnerable parser triggers the out-of-bounds write and executes the attacker's shellcode. See the Adobe Security Advisory APSB24-58 for vendor details.

Detection Methods for CVE-2024-39384

Indicators of Compromise

Unexpected child processes spawned by Adobe Premiere Pro.exe (Windows) or Adobe Premiere Pro (macOS), especially command shells, scripting hosts, or rundll32.exe.
Premiere Pro crashes or exception events immediately after opening a project or media file received from an untrusted source.
New persistence artifacts (Run keys, scheduled tasks, LaunchAgents) created during or shortly after Premiere Pro sessions.

Detection Strategies

Alert on Premiere Pro process trees launching interpreters such as powershell.exe, cmd.exe, wscript.exe, bash, or osascript.
Correlate Windows Error Reporting or macOS crash reports for Premiere Pro with subsequent outbound network connections from the same host.
Hunt for Premiere Pro reading project files from unusual paths (email attachment cache, browser downloads, removable media) followed by writes to autorun locations.

Monitoring Recommendations

Track installed Premiere Pro versions across endpoints and flag hosts running 24.5, 23.6.8, or earlier as unpatched.
Monitor endpoint telemetry for module loads and memory allocations from Premiere Pro that resolve to non-Adobe signed binaries.
Ingest EDR process and file telemetry into a centralized data lake to support retroactive hunts once new IOCs emerge.

How to Mitigate CVE-2024-39384

Immediate Actions Required

Upgrade Premiere Pro to the fixed releases listed in Adobe bulletin APSB24-58 on all Windows and macOS workstations.
Inventory endpoints that run creative software and prioritize patching for hosts that handle files from external partners or clients.
Instruct users to open Premiere Pro project files only from trusted sources and to verify the sender before opening emailed assets.

Patch Information

Adobe released fixed Premiere Pro builds addressing CVE-2024-39384. Refer to the Adobe Security Advisory APSB24-58 for the exact patched version numbers and download instructions for both Windows and macOS. Apply updates through the Creative Cloud desktop application or your managed software distribution system.

Workarounds

No official workaround exists; applying the vendor patch is the only supported remediation.
Until patching completes, block execution of Premiere Pro on high-risk endpoints using application allow-listing policies.
Restrict delivery of .prproj, .prfpset, and unusual media container files at the email gateway or web proxy for users who do not require them.

bash

# Query Creative Cloud installed versions on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Premiere Pro*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation