The vulnerability is an out‑of‑bounds write in Adobe Media Encoder that can lead to arbitrary code execution, as identified by CWE‑787. Attacks that manage to trigger the flaw could replace arbitrary memory contents and subsequently carry out arbitrary code in the context of the user who runs the program. The CVSS scores indicate a high severity, with a base score of 7.8, reflecting the significant impact if an attacker successfully abuses the exploit.

Affected versions are Adobe Media Encoder 26.0.2, 25.6.4, and all earlier releases. A file in any of these releases that contains malicious data can be used to trigger the overflow. Users of older releases should be aware that the flaw will remain until a newer version is installed.

The exploitation requires user interaction; a maliciously crafted file must be opened by the victim. Because the flaw is triggered by a local file, the most likely vector is social‑engineering or phishing attachments. The EPSS score is missing, but the high CVSS base score and lack of a KEV listing indicate that this is a serious risk that should be addressed promptly.