CVE-2026-47979: Adobe Media Encoder Info Disclosure Flaw

CVE-2026-47979 Overview

Adobe Media Encoder contains an out-of-bounds read vulnerability [CWE-125] that can disclose sensitive process memory to a local attacker. The flaw is triggered when a victim opens a crafted media file with a vulnerable version of Media Encoder. Successful exploitation exposes memory contents that may include pointers, cryptographic material, or other data useful for further attack stages.

Adobe published the issue in security advisory APSB26-72. Exploitation requires user interaction and local access, and no public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Critical Impact
A local attacker who convinces a user to open a malicious media file can read out-of-bounds memory from the Media Encoder process, leading to disclosure of sensitive information.

Affected Products

Adobe Media Encoder (versions listed in Adobe advisory APSB26-72)
Windows installations of Adobe Media Encoder
macOS installations of Adobe Media Encoder

Discovery Timeline

2026-07-14 - CVE-2026-47979 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-47979

Vulnerability Analysis

The vulnerability is classified as an out-of-bounds read [CWE-125] in Adobe Media Encoder. Media Encoder parses a wide range of container and codec formats, and specially crafted input can cause the parser to read memory beyond the bounds of an allocated buffer. The read data is not returned directly over the network but can be reflected in application state, logs, or subsequent processing that an attacker can influence.

Because the attack vector is local and requires user interaction, exploitation depends on social engineering. The confidentiality impact is high, while integrity and availability are not affected. The vulnerability does not grant code execution on its own but can be chained with memory corruption bugs to defeat address space layout randomization (ASLR).

Root Cause

The root cause is missing or insufficient bounds checking when Media Encoder parses fields in a malicious media file. The parser trusts a length or offset value from the file and dereferences memory outside the intended buffer. This is a common pattern in media framework code that handles variable-length structures such as codec headers, metadata atoms, or index tables.

Attack Vector

An attacker crafts a malicious media file and delivers it to a target through email, a download link, or a shared project asset. When the victim opens the file in Adobe Media Encoder, the parser triggers the out-of-bounds read. The attacker must control the file contents but does not require any privileges on the target system. The disclosed memory may include process pointers, decoded frame buffers, or fragments of other user data resident in the process address space.

No public proof-of-concept code is available. Adobe's advisory APSB26-72 should be consulted for the authoritative technical description.

Detection Methods for CVE-2026-47979

Indicators of Compromise

Unexpected Adobe Media Encoder crashes or hangs after opening third-party media files, particularly from untrusted sources.
Media files delivered from external email or messaging platforms that are opened directly in Media Encoder rather than staged through a controlled ingest workflow.
Anomalous child process creation or file writes originating from Adobe Media Encoder.exe shortly after a suspect file is opened.

Detection Strategies

Inventory installed versions of Adobe Media Encoder across endpoints and flag any version not listed as fixed in advisory APSB26-72.
Correlate file-open events for media file extensions (.mp4, .mov, .mxf, .wav) with Media Encoder process telemetry to identify suspicious open-then-crash sequences.
Use endpoint detection and response (EDR) telemetry to alert on Media Encoder loading unusual DLLs or spawning unexpected child processes.

Monitoring Recommendations

Enable process crash and Windows Error Reporting (WER) forwarding for Adobe creative applications to central logging.
Monitor file downloads and email attachments with media extensions arriving from external senders and route them through sandbox analysis before end-user delivery.
Track patch status for Adobe Creative Cloud applications and alert on hosts running versions predating the APSB26-72 fix.

How to Mitigate CVE-2026-47979

Immediate Actions Required

Apply the Adobe Media Encoder update referenced in the Adobe Security Advisory APSB26-72 on all affected endpoints.
Instruct users to avoid opening media files received from untrusted sources directly in Media Encoder until patches are deployed.
Verify Adobe Creative Cloud auto-update is enabled and functional across managed workstations.

Patch Information

Adobe has released a fixed version of Media Encoder as documented in Adobe Security Advisory APSB26-72. Administrators should deploy the update through Adobe Creative Cloud Desktop or the Adobe Admin Console for enterprise deployments. Confirm installed version numbers against the fixed versions listed in the advisory after deployment.

Workarounds

Restrict opening of media files to those originating from trusted internal storage and validated project sources.
Use a dedicated, network-isolated workstation for triaging untrusted media assets received from external parties.
Apply application allowlisting to prevent execution of files that Media Encoder may drop or hand off to downstream processes.

bash

# Verify installed Adobe Media Encoder version on Windows
reg query "HKLM\SOFTWARE\Adobe\Adobe Media Encoder" /s | findstr /i "Version"

# Verify installed Adobe Media Encoder version on macOS
defaults read "/Applications/Adobe Media Encoder <year>/Adobe Media Encoder <year>.app/Contents/Info.plist" CFBundleShortVersionString