CVE-2026-34638: Adobe Premiere Pro RCE Vulnerability

CVE-2026-34638 Overview

CVE-2026-34638 is a Use After Free vulnerability [CWE-416] affecting Adobe Premiere Pro versions 26.0.2, 25.6.4, and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The vulnerability requires user interaction, as a victim must open a malicious file crafted by an attacker. Adobe addressed the issue in security advisory APSB26-46, published on the vendor's security portal.

Critical Impact

Attackers can achieve arbitrary code execution on Windows and macOS systems running vulnerable Premiere Pro versions when a user opens a malicious project or media file.

Affected Products

• Adobe Premiere Pro 26.0.2 and earlier
• Adobe Premiere Pro 25.6.4 and earlier
• Microsoft Windows and Apple macOS host platforms

Discovery Timeline

• 2026-05-12 - CVE-2026-34638 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34638

Vulnerability Analysis

The flaw is a Use After Free condition in Adobe Premiere Pro's file parsing logic. The application references memory that has already been freed when processing a specially crafted file. An attacker controlling the freed memory region can redirect execution flow to attacker-supplied code. The result is arbitrary code execution under the privileges of the user running Premiere Pro.

The attack vector is local and requires user interaction. A victim must open a malicious file, typically delivered through phishing, file-sharing platforms, or compromised project repositories. No elevated privileges are required for the attacker to weaponize the file.

Root Cause

The root cause is improper memory management classified under [CWE-416] Use After Free. Premiere Pro continues to reference a pointer after the underlying object has been deallocated. When the dangling pointer is dereferenced during subsequent parsing operations, an attacker can place controlled data at the freed location. This results in corrupted object state and hijacked control flow.

Attack Vector

Exploitation requires delivering a malicious media or project file to the victim. The attacker crafts a file that triggers the specific allocation, deallocation, and reuse sequence in Premiere Pro. When the user opens the file, the vulnerable code path executes the attacker's payload. Code runs with the permissions of the logged-on user, enabling data theft, persistence, or lateral movement.

No public proof-of-concept code has been published for this vulnerability. See the Adobe Security Advisory APSB26-46 for vendor-supplied technical context.

Detection Methods for CVE-2026-34638

Indicators of Compromise

• Unexpected child processes spawned by Adobe Premiere Pro.exe on Windows or the Premiere Pro process on macOS, particularly shells, scripting engines, or rundll32.exe.
• Premiere Pro crash dumps or Windows Error Reporting events that coincide with opening third-party project files from untrusted sources.
• Outbound network connections initiated by the Premiere Pro process to unknown hosts shortly after a file open event.

Detection Strategies

• Hunt for process lineage anomalies where Premiere Pro spawns interpreters such as powershell.exe, cmd.exe, wscript.exe, bash, or osascript.
• Inspect file write events where Premiere Pro creates executables, scripts, or scheduled task artifacts outside of its normal media output directories.
• Correlate Premiere Pro crash telemetry with subsequent suspicious process or network activity on the same host.

Monitoring Recommendations

• Forward endpoint process, file, and module-load telemetry to a centralized analytics platform for retrospective hunting against this CVE.
• Track Premiere Pro version inventory across managed endpoints to identify hosts still running 26.0.2, 25.6.4, or earlier.
• Alert on Premiere Pro opening files from email attachments, browser downloads, or removable media paths.

How to Mitigate CVE-2026-34638

Immediate Actions Required

• Apply the patched Adobe Premiere Pro releases referenced in APSB26-46 to all affected Windows and macOS workstations.
• Instruct users not to open Premiere Pro project files or media received from untrusted or unverified sources.
• Audit endpoint inventory to confirm no installations of 26.0.2, 25.6.4, or earlier remain in production.

Patch Information

Adobe published fixed versions in advisory APSB26-46. Administrators should deploy the updated builds through the Adobe Creative Cloud desktop application or enterprise software distribution tooling. Verify successful installation by checking the Premiere Pro Help menu for the patched version number.

Workarounds

• Restrict Premiere Pro usage to project files originating from trusted internal storage or version-controlled asset libraries.
• Run Premiere Pro under a standard user account rather than a privileged account to limit the blast radius of code execution.
• Use application allowlisting to block child processes from being spawned by Premiere Pro until patching is complete.

# Verify installed Premiere Pro version on macOS
defaults read "/Applications/Adobe Premiere Pro 2026/Adobe Premiere Pro 2026.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Premiere Pro version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Premiere Pro*" } |
  Select-Object DisplayName, DisplayVersion