CVE-2026-34640

Media Encoder | Integer Overflow or Wraparound (CWE-190)

Published May 12, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Analysis

Technical impact

A vulnerability involving an integer overflow or wraparound in Adobe Media Encoder exists in versions 26.0.2, 25.6.4 and earlier. The flaw can be triggered when a user opens a crafted file and may allow an attacker to execute arbitrary code within the context of the current user.

Affected Systems

Adobe Media Encoder, specifically version 26.0.2 and 25.6.4 as well as all earlier releases. Users of these versions are at risk unless they upgrade to a newer, patched build.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, exploitation requires user interaction – the victim must open a malicious file. Consequently, the likelihood of an attack depends on user behavior and the presence of malicious media files.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Adobe

Adobe Media Encoder

unaffected

Version	Status	Constraints
`0`	affected	≤ 26.0.2
`26.2`	unaffected	—
`0`	affected	≤ 25.6.4
`25.6.5`	unaffected	—

Configuration 1 [-]

OR	cpe:2.3:a:adobe:media_encoder::::::::
	cpe:2.3:a:adobe:media_encoder::::::::

No data.

Vendor Product Versions

Adobe

Media Encoder

Version	Status	Scheme	Platform
`[0,25.6.4]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update Adobe Media Encoder to the latest release that resolves the integer overflow issue.
While an update is pending, prevent opening unknown or untrusted files in Media Encoder and disable automatic file opening features.
Deploy endpoint protection and monitor for any attempts to exploit the vulnerability.

Generated by OpenCVE AI on May 12, 2026 at 19:04 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.170% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html

History

May 13, 2026 7:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:adobe:media_encoder::::::::

May 12, 2026 8:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Adobe Adobe media Encoder
Vendors & Products		Adobe Adobe media Encoder

May 12, 2026 7:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 12, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title		Media Encoder \| Integer Overflow or Wraparound (CWE-190)
Weaknesses		CWE-190
References		https://helpx.adobe.com/security/products/media-encoder/apsb26-47.html
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`