CVE-2026-21312
Published: 10 February 2026
Summary
CVE-2026-21312 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Audition. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 2.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the out-of-bounds write vulnerability by requiring timely patching of Adobe Audition to version 25.4 or later as specified in Adobe's security bulletin.
Implements memory safeguards such as address space layout randomization and data execution prevention to block arbitrary code execution from out-of-bounds writes.
Malicious code protection mechanisms scan and block crafted malicious files before they can be opened in vulnerable Audition versions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directly enables arbitrary code execution via user opening of a malicious file (User Execution: Malicious File).
NVD Description
Audition versions 25.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a…
more
malicious file.
Deeper analysisAI
CVE-2026-21312 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Audition versions 25.3 and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files. The vulnerability was published on 2026-02-10 and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts with low attack complexity but requiring local access and user interaction.
Exploitation requires an attacker to trick a victim into opening a specially crafted malicious file within the affected Audition software. No privileges are needed (PR:N), but the attack is local (AV:L) and depends on user interaction (UI:R), such as double-clicking a file. Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially enabling full system compromise if the user has elevated rights.
Adobe's security bulletin APSB26-14, available at https://helpx.adobe.com/security/products/audition/apsb26-14.html, provides details on the vulnerability and recommends updating to Audition version 25.4 or later, where the issue has been addressed. Security practitioners should advise users to apply patches promptly and avoid opening untrusted files in vulnerable versions.
Details
- CWE(s)