Adobe Premiere Pro is vulnerable to an out‑of‑bounds write that can give an attacker the ability to execute arbitrary code while running under the current user’s privileges. This flaw manifests when the application processes data from an external file, corrupting internal memory structures and allowing a malicious payload to be injected. The vulnerability is consequently serious because it can elevate an attacker’s access from local to system‑boundary within the user’s process.

Adobe Premiere Pro versions 26.0.2, 25.6.4 and all earlier releases are affected. The flaw exists across these major releases, meaning any system still running one of these builds could be compromised.

With a CVSS score of 7.8 the flaw ranks high enough to warrant urgent attention, and the EPSS is currently not available, indicating limited data to gauge current exploitation rates. The attack vector requires user interaction – a victim must open a crafted file – so the threat is restricted to phishing or social engineering scenarios where the user is tricked into opening a malicious media file. The vulnerability is not listed in the CISA KEV catalog, but its potential for arbitrary code execution and high severity justify prompt remediation.