Premiere Pro up to version 25.5 contains an out‑of‑bounds read that enables an attacker to read beyond an allocated buffer while parsing a crafted media file. The flaw can be exploited to execute code in the context of the current user, potentially allowing full control of the host system. Because the vulnerability requires the user to open a malicious file, it is a local code‑execution risk that can be leveraged by social engineering or malware distribution techniques.

Adobe Premiere Pro on both macOS and Windows platforms is affected; all installations running version 25.5 or earlier are vulnerable. The files must be processed by the application on either OS.

The CVSS score of 7.8 classifies the flaw as high severity. EPSS indicates less than 1 percent probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires a crafted file and user interaction; an attacker typically would need to convince a target to open or preview the file, making the attack medium‑to‑low risk in uncontrolled environments.