CVE-2026-48365: Adobe Audition RCE Vulnerability

CVE-2026-48365 Overview

CVE-2026-48365 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Audition on Windows and macOS. Successful exploitation results in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically that the victim opens a crafted malicious file in Audition.

Adobe published details in security advisory APSB26-71. The vulnerability carries a local attack vector and does not require prior authentication. No public proof-of-concept code is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Opening a malicious audio project file in Adobe Audition allows an attacker to execute arbitrary code with the privileges of the logged-in user, enabling malware installation or lateral movement.

Affected Products

Adobe Audition (see Adobe Security Advisory APSB26-71 for affected versions)
Microsoft Windows installations of Adobe Audition
Apple macOS installations of Adobe Audition

Discovery Timeline

2026-07-14 - CVE-2026-48365 published to the National Vulnerability Database
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-48365

Vulnerability Analysis

The flaw is an out-of-bounds write condition within Adobe Audition's file parsing logic. When Audition processes a malformed media or project file, the application writes data beyond the boundaries of an allocated memory buffer. This corruption of adjacent memory structures can be leveraged to overwrite function pointers, return addresses, or object metadata used later in execution flow.

Because the write occurs in the address space of the user-launched Audition process, code execution inherits the privileges of that user. On workstations where users operate with administrator rights, the impact extends to full system compromise. On standard user accounts, attackers gain a foothold suitable for credential theft or persistence.

The issue is classified under [CWE-787: Out-of-bounds Write]. Adobe's advisory APSB26-71 addresses this issue alongside related media-handling flaws.

Root Cause

The root cause is missing or insufficient bounds checking when Audition parses attacker-controlled file structures. A field within the malicious file, such as a chunk length or offset value, is trusted without validation. Audition then writes decoded content past the end of a fixed-size buffer.

Attack Vector

Exploitation requires local file access and user interaction. An attacker delivers a weaponized audio or session file via phishing email, file-sharing service, or drive-by download. The victim must open the file in Adobe Audition to trigger the vulnerable parser. Network-based exploitation without user action is not possible.

No verified public exploit code exists for CVE-2026-48365. Refer to the Adobe Security Advisory APSB26-71 for vendor-supplied technical details.

Detection Methods for CVE-2026-48365

Indicators of Compromise

Audition process (Adobe Audition.exe on Windows, Adobe Audition on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or osascript
Unexpected outbound network connections initiated by the Audition process shortly after opening a file
Audition process crashes with access violation or segmentation fault entries in Windows Event Log or macOS crash reports coinciding with third-party file opens
New executable files, scheduled tasks, or LaunchAgents created in the user profile immediately after Audition activity

Detection Strategies

Monitor process lineage for Adobe Audition and alert on any child process outside the expected set of Adobe helpers and updaters
Deploy YARA rules that inspect audio and session files (.sesx, .wav, .aif, .mp3) from untrusted sources for structural anomalies
Correlate Audition crash telemetry with subsequent process creation or file write events on the same host
Flag execution of Audition on files originating from email attachments, browser downloads, or removable media using file provenance metadata

Monitoring Recommendations

Enable command-line and process-creation auditing (Windows Event ID 4688, macOS Endpoint Security framework) on hosts running Adobe Audition
Ingest endpoint telemetry into a centralized platform to correlate Audition parent-child process relationships across the fleet
Track installed Adobe Audition versions through software inventory to identify unpatched systems referenced in APSB26-71

How to Mitigate CVE-2026-48365

Immediate Actions Required

Apply the Adobe Audition security update referenced in Adobe Security Advisory APSB26-71 on all Windows and macOS endpoints
Instruct users to avoid opening Audition project or audio files received from untrusted sources until patching is complete
Audit endpoints for outdated Audition installations using software inventory tools and prioritize remediation on hosts used by high-privilege users

Patch Information

Adobe released a fixed version of Audition addressing CVE-2026-48365. Consult Adobe Security Advisory APSB26-71 for the exact patched version numbers and download links for Windows and macOS. Update through the Adobe Creative Cloud desktop application or the enterprise Admin Console.

Workarounds

Restrict opening of audio and session files sourced from external senders using email gateway policies that quarantine uncommon media attachments
Enforce standard user rights rather than local administrator rights on workstations running Adobe Audition to limit blast radius of successful exploitation
Use application allowlisting to prevent Audition from spawning script interpreters or command shells

bash

# Verify installed Adobe Audition version on macOS
defaults read "/Applications/Adobe Audition 2026/Adobe Audition 2026.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Adobe Audition version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Adobe Audition*" } |
  Select-Object DisplayName, DisplayVersion