Multiple Vulnerabilities in Adobe Products

Affected Environment

Adobe After Effects, Commerce, Connect, Media Encoder, Premiere Pro, Substance 3D Designer/Painter/Sampler, Content Authenticity SDK, Illustrator, and Magento.

Threat Overview

53 CVEs including buffer overflows, out-of-bounds writes, XSS, path traversal, SSRF, deserialization, and improper authorisation flaws.

Exposure Timeline

Disclosed 12–13 May 2026; products have auto-update options; classified as Informative Cyber Alert.

Attack Surface

Client-side file parsing, web application endpoints, CLI interfaces, and browser-rendered content across Windows and macOS platforms.

Technical Root Cause

Stack/heap buffer overflows, integer overflows, improper input validation, missing authorisation checks, and unsafe deserialization of untrusted data.

Exploitation Pathway

Attackers deliver maliciously crafted files or web content; logged-on user opens file or visits attacker-controlled page to trigger execution.