CVE-2024-20772: Adobe Media Encoder 2024 AI file parsing Stack based buffer overflow

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-10 · updated 2026-06-17
Weakness: CWE-121

Description

Media Encoder versions 24.2.1, 23.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

Adobe Media Encoder: before 23.6.5; from 24.0 before 24.3 — fixed in 23.6.5, 24.3

How to fix

Upgrade to a fixed version: Adobe Media Encoder 23.6.5, 24.3. Check the vendor advisory for mitigations.

References

https://helpx.adobe.com/security/products/media-encoder/apsb24-23.html
https://helpx.adobe.com/security/products/media-encoder/apsb24-23.html

Get alerted when CVE-2024-20772 or the next vulnerability affects your stack