CVE-2026-47967: Adobe Audition RCE Vulnerability

CVE-2026-47967 Overview

CVE-2026-47967 is an out-of-bounds write vulnerability [CWE-787] in Adobe Audition that enables arbitrary code execution in the context of the current user. Exploitation requires a victim to open a crafted media file in the affected application. The flaw affects Adobe Audition on both Microsoft Windows and Apple macOS platforms. Adobe published the vulnerability under security advisory APSB26-71.

Critical Impact
A successful exploit lets an attacker execute arbitrary code with the privileges of the user running Adobe Audition, potentially leading to full compromise of the user session and access to user data.

Affected Products

Adobe Audition
Apple macOS
Microsoft Windows

Discovery Timeline

2026-07-14 - CVE-2026-47967 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-47967

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition [CWE-787] within Adobe Audition's file parsing logic. When Audition processes a malformed audio or project file, it writes data past the boundaries of an allocated memory buffer. This corruption can overwrite adjacent memory structures, including function pointers or heap metadata. An attacker who controls the overwritten bytes can redirect execution to attacker-supplied code. The vulnerability is triggered locally through file parsing, and Audition executes the resulting code with the privileges of the current user.

Root Cause

The root cause is missing or insufficient bounds checking during the parsing of untrusted input in a media container or project file. The application trusts size or offset fields embedded in the file without validating them against the actual allocation size before performing a write. See the Adobe Security Advisory APSB26-71 for vendor-specific technical details.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious audio or project file and delivers it via email, chat, download link, or shared storage. When the victim opens the file in Adobe Audition, the parsing routine triggers the out-of-bounds write. Execution occurs in the user context, so any files, credentials, or cloud sessions accessible to that user become reachable to the attacker.

Detection Methods for CVE-2026-47967

Indicators of Compromise

Unexpected crashes of Adobe Audition.exe or Adobe Audition on macOS shortly after opening third-party media files.
Child processes spawned by Audition that are not part of normal application behavior, such as command shells, script interpreters, or LOLBins.
Outbound network connections initiated by Audition to unfamiliar hosts following the opening of a media file.

Detection Strategies

Monitor process ancestry for Adobe Audition spawning cmd.exe, powershell.exe, wscript.exe, bash, or osascript.
Alert on file writes by Audition to autorun locations, scheduled task paths, or LaunchAgents directories on macOS.
Correlate application crash telemetry with subsequent file execution or persistence events on the same host.

Monitoring Recommendations

Ingest EDR process, file, and network telemetry into a centralized data lake for cross-source correlation.
Track Adobe Audition version inventory across managed endpoints to identify unpatched installations.
Baseline normal Audition behavior so anomalous child process creation and network activity generate high-fidelity alerts.

How to Mitigate CVE-2026-47967

Immediate Actions Required

Apply the update referenced in Adobe security bulletin APSB26-71 to all systems running Adobe Audition on Windows and macOS.
Instruct users to avoid opening audio or project files received from untrusted sources until patching is complete.
Restrict Audition from running under privileged accounts and enforce least-privilege on user workstations.

Patch Information

Adobe has released fixed versions of Adobe Audition as detailed in the Adobe Security Advisory APSB26-71. Administrators should deploy the vendor-supplied update through Adobe Creative Cloud or their enterprise software distribution platform.

Workarounds

Block delivery of uncommon or unexpected audio and session file extensions at the email gateway when feasible.
Enforce application control policies that prevent Adobe Audition from launching child processes such as shells or scripting engines.
Use operating system exploit mitigations, including ASLR, DEP, and Control Flow Guard on Windows, to raise exploitation cost while patching is in progress.

bash

# Verify installed Adobe Audition version on Windows
reg query "HKLM\SOFTWARE\Adobe\Audition" /s /v Version

# Verify installed Adobe Audition version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Audition 2026/Adobe Audition 2026.app"