Adobe Media Encoder vulnerabilities

65 CVEs affecting Adobe Media Encoder, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-48370, published 2026-07-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-7844, published 2019-05-22. Medium severity, CVSS 6.5. EPSS: 9.1% chance of exploitation in the next 30 days. Adobe Media Encoder version 13.0.2 has an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7842, published 2019-05-22. High severity, CVSS 8.8. EPSS: 8.7% chance of exploitation in the next 30 days. Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability. Successful exploitation could lead to remote code execution.
CVE-2020-3764, published 2020-02-20. High severity, CVSS 7.8. EPSS: 5.1% chance of exploitation in the next 30 days. Adobe Media Encoder versions 14.0 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-8246, published 2019-11-14. Critical severity, CVSS 9.8. EPSS: 4.6% chance of exploitation in the next 30 days. Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2021-36070, published 2021-09-01. High severity, CVSS 7.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Media Encoder version 15.1 (and earlier) is affected by an improper memory access vulnerability when parsing a crafted .SVG file. An attacker could leverage this vulnerability to execute code…
CVE-2021-42721, published 2021-11-16. High severity, CVSS 7.8. EPSS: 3.7% chance of exploitation in the next 30 days. Acrobat Bridge versions 11.1.1 and earlier are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the context of the…
CVE-2021-36015, published 2021-08-20. High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days. Adobe Media Encoder version 15.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to…
CVE-2020-9650, published 2020-07-17. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. Adobe Media Encoder versions 14.2 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2019-8244, published 2019-11-14. Medium severity, CVSS 4.3. EPSS: 3.3% chance of exploitation in the next 30 days. Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-8243, published 2019-11-14. Medium severity, CVSS 4.3. EPSS: 3.3% chance of exploitation in the next 30 days. Adobe Media Encoder versions 13.1 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Latest

CVE-2026-48370, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-48366, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-47979, published 2026-07-14. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information.…
CVE-2026-47976, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-47971, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
CVE-2026-34640, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user.…
CVE-2026-34639, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
CVE-2025-27195, published 2025-04-08. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.…
CVE-2025-27194, published 2025-04-08. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of…
CVE-2024-49554, published 2024-12-10. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Media Encoder versions 25.0, 24.6.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this…