#202020

Adobe Security Bulletin

Last updated on May 12, 2026

Security Updates Available for Adobe Media Encoder | APSB26-47

Bulletin ID
Date published
Priority
APSB26-47
May 12, 2026
3
style
grid width 12

Summary

Adobe has released an update for Adobe Media Encoder. This update resolves critical vulnerabilities that could lead to arbitrary code execution.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Version
Platform
Adobe Media Encoder
25.6.4 and earlier versions
Windows and macOS
Adobe Media Encoder
26.0.2 and earlier versions
Windows and macOS
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism. For more information, please reference this help page.

Product
Version
Platform
Priority
Adobe Media Encoder
25.6.5
Windows and macOS
3
Adobe Media Encoder
26.2
Windows and macOS
3
For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.
style
grid width 12

Note

For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.

style
xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-34639
Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-34640
Vulnerability category: Integer Overflow or Wraparound (CWE-190)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Acknowledgments

Adobe would like to thank the following for reporting these issues and for working with Adobe to help protect our customers:

  • yjdfy -- CVE-2026-34639, CVE-2026-34640

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com

CardTitle
APSB26-47
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-05-12
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/media-encoder
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/adobe-media-encoder
Arbitrary
search: CVE-2026-34639 CVE-2026-34640