CVE-2026-21316

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21316", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2025-12-12T22:01:18.193Z", "datePublished": "2026-02-10T17:45:15.912Z", "dateUpdated": "2026-08-27T22:02:43.819Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Audition", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}], "datePublic": "2026-02-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "NONE", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-788", "description": "Access of Memory Location After End of Buffer (CWE-788)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:43.819Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/audition/apsb26-14.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Audition | Access of Memory Location After End of Buffer (CWE-788)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T15:21:33.304851Z", "id": "CVE-2026-21316", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:21:45.604Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21316", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-11T15:21:33.304851Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T15:21:38.683Z"}}], "cna": {"title": "Audition | Access of Memory Location After End of Buffer (CWE-788)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 5.5, "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "HIGH", "environmentalScore": 5.5, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "NONE", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Audition", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.3"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/audition/apsb26-14.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-788", "description": "Access of Memory Location After End of Buffer (CWE-788)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:43.819Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21316", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:02:43.819Z", "dateReserved": "2025-12-12T22:01:18.193Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-02-10T17:45:15.912Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Audition", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.3", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:audition:*:*:*:*:*:*:*:*", "matchCriteriaId": "D3D84C83-FC42-4BB7-8468-F8063EDF40F4", "versionEndExcluding": "25.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Audition versions 25.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones 25.3 y anteriores de Audition est\u00e1n afectadas por una vulnerabilidad de Acceso a Ubicaci\u00f3n de Memoria Despu\u00e9s del Fin del B\u00fafer que podr\u00eda conducir a una denegaci\u00f3n de servicio de la aplicaci\u00f3n. Un atacante podr\u00eda explotar esta vulnerabilidad para provocar que la aplicaci\u00f3n se bloquee o deje de responder. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, ya que una v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-21316", "lastModified": "2026-08-28T00:16:55.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21316", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T15:21:33.304851Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:28.870", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/audition/apsb26-14.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-788"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.3]"}}], "product": "audition", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-18T12:49:29.501489+00:00", "value": {"mitigation_remediation": ["Upgrade Adobe Audition to the latest patch version that addresses the memory boundary issue.", "Restrict users from opening unknown or untrusted media files in Audition unless verified.", "Monitor application logs and system stability for signs of crashes or hangs linked to media file handling."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Adobe Audition products distributed to users under copyright of Adobe. All installations running version 25.3 or older are impacted. More recent releases after 25.3 have fixed the flaw.", "description_and_impact": "Adobe Audition versions 25.3 and earlier contain a memory corruption flaw. Based on the description, it is inferred that the flaw involves memory access beyond the end of a buffer, which may lead to a crash or become unresponsive, resulting in a denial of service. The weakness is identified as CWE\u2011788.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a victim to open a specially crafted file; thus the attack vector is local file-based and needs user interaction. Because of the low probability and the lack of remote access requirements, the overall risk is moderate but still significant enough to warrant timely remediation."}}}}, "created": "2026-02-10T21:33:48.921038+00:00", "updated": "2026-04-18T13:00:08.724937+00:00", "vendors": ["adobe", "adobe$PRODUCT$audition"]}