Adobe Audition: NULL pointer dereference leads to application crash
Summary
Adobe Audition contains a NULL pointer dereference (CWE-476) that can crash the application. An attacker can exploit it by tricking a local user into opening a malicious file, which causes a denial-of-service condition. The vulnerability affects confidentiality and integrity not at all; the impact is limited to availability.
Affected
- Adobe Audition 26.5 and earlier (Windows and macOS)
- Adobe Audition 25.6.6 and earlier (Windows and macOS)
Fixed in
- Adobe Audition 27.0 (Windows and macOS)
- Adobe Audition 26.5.3 (Windows and macOS)
- The advisory lists no separate fixed build for the 25.x branch; move 25.x installations to 26.5.3 or 27.0.
Workaround
- Unknown.
- Until the update is installed, do not open audio or video files from unknown or untrusted sources in Audition (recommendation of the research team, not a vendor instruction).
Exploitation
- Adobe is not aware of any exploits in the wild for any issue in APSB26-102.
- Exploitation status of CVE-2026-113549 is not confirmed by the vendor; a third-party tracker lists it as not known to be exploited.
- No public proof of concept found; this does not prove that none exists.
- CISA SSVC: Exploitation none, Automatable no.
Our recommendation
- Inventory all Adobe Audition installations on Windows and macOS.
- Update to Audition 26.5.3 or 27.0 via the Creative Cloud desktop app or Adobe Download Center; do not patch 25.x in place.
- Apply the entire APSB26-102 update as one action, since it also fixes several high-severity issues, including arbitrary code execution flaws.
- Until patched, restrict opening untrusted media files.
- Monitor NVD for the final analysis of CVE-2026-113549.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-102 www.adobe.com
- CVE-2026-113549 tracker (OffSeq) radar.offseq.com
- CVE-2026-113549 (Strix) www.strix.ai
- CVE-2026-113549 (threatint) cve.threatint.com
- CVE-2026-113553 (Strix) www.strix.ai
- HKCERT Adobe monthly security update November 2026 www.hkcert.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:15.
Original description (NVD)
Audition is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.