CVE-2026-27269

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27269", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.387Z", "datePublished": "2026-03-10T18:33:45.782Z", "dateUpdated": "2026-08-27T22:09:50.864Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Premiere", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.5", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Premiere Pro", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.5", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}]}], "datePublic": "2026-03-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Premiere Pro versions 25.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:50.864Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/premiere_pro/apsb26-28.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Premiere Pro | Out-of-bounds Read (CWE-125)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-27269"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T03:56:57.635Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27269", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-10T19:06:48.354983Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T19:10:40.214Z"}}], "cna": {"title": "Premiere Pro | Out-of-bounds Read (CWE-125)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 7.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 7.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Premiere", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.5"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Premiere Pro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.5"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/premiere_pro/apsb26-28.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Premiere Pro versions 25.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:50.864Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27269", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:09:50.864Z", "dateReserved": "2026-02-18T22:02:41.387Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-03-10T18:33:45.782Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Premiere", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.5", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Premiere Pro", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.5", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:premiere_pro:*:*:*:*:*:*:*:*", "matchCriteriaId": "56FE5FBC-CC08-4CF5-BF94-9A37D4F7F12D", "versionEndExcluding": "25.6", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Premiere Pro versions 25.5 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Versiones 25.5 y anteriores de Premiere Pro se ven afectadas por una vulnerabilidad de lectura fuera de l\u00edmites al analizar un archivo manipulado, lo que podr\u00eda resultar en una lectura m\u00e1s all\u00e1 del final de una estructura de memoria asignada. Un atacante podr\u00eda aprovechar esta vulnerabilidad para ejecutar c\u00f3digo en el contexto del usuario actual. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, ya que una v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27269", "lastModified": "2026-08-28T00:17:09.917", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27269", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-03-10T19:17:18.980", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/premiere_pro/apsb26-28.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,25.5]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Premiere Pro", "source": "cna", "vendor": "Adobe"}, "product": "premiere_pro", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-16T03:38:37.064471+00:00", "value": {"mitigation_remediation": ["Upgrade Adobe Premiere Pro to the latest major version that is greater than 25.5", "Configure the application or environment so it does not automatically open media files, and verify that only trusted files are processed", "Apply standard file\u2011type validation or sandboxing where possible to isolate the media processing pipeline"], "summary": {"action": "Apply Patch", "impact": "Execution of code in user context"}, "threat_synthesis": {"affected_systems": "Adobe Premiere Pro on both macOS and Windows platforms is affected; all installations running version 25.5 or earlier are vulnerable. The files must be processed by the application on either OS.", "description_and_impact": "Premiere Pro up to version 25.5 contains an out\u2011of\u2011bounds read that enables an attacker to read beyond an allocated buffer while parsing a crafted media file. The flaw can be exploited to execute code in the context of the current user, potentially allowing full control of the host system. Because the vulnerability requires the user to open a malicious file, it is a local code\u2011execution risk that can be leveraged by social engineering or malware distribution techniques.", "risk_and_exploitability": "The CVSS score of 7.8 classifies the flaw as high severity. EPSS indicates less than 1 percent probability of exploitation, and the vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires a crafted file and user interaction; an attacker typically would need to convince a target to open or preview the file, making the attack medium\u2011to\u2011low risk in uncontrolled environments."}}}}, "created": "2026-03-11T11:43:57.631123+00:00", "updated": "2026-04-16T03:45:16.016770+00:00", "vendors": ["adobe", "adobe$PRODUCT$premiere_pro"]}