CVE-2021-43747
📋 TL;DR
Adobe Premiere Rush versions 1.5.16 and earlier contain a memory corruption vulnerability when processing malicious WAV files. This could allow attackers to execute arbitrary code with the privileges of the current user. Users who open untrusted WAV files in affected versions are at risk.
💻 Affected Systems
- Adobe Premiere Rush
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via arbitrary code execution leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation leading to user account compromise and potential lateral movement within the network.
If Mitigated
Limited impact if user runs with minimal privileges and doesn't open untrusted files.
🎯 Exploit Status
Requires user to open a malicious WAV file. No public exploit code available as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.5.17 or later
Vendor Advisory: https://helpx.adobe.com/security/products/premiere_rush/apsb21-101.html
Restart Required: Yes
Instructions:
1. Open Adobe Premiere Rush
2. Go to Help > Check for Updates
3. Install update to version 1.5.17 or later
4. Restart the application
🔧 Temporary Workarounds
Disable WAV file association
allPrevent Premiere Rush from automatically opening WAV files
Windows: Control Panel > Default Programs > Associate a file type > Remove .wav association with Premiere Rush
macOS: Right-click .wav file > Get Info > Open With > Change to different application
User awareness training
allEducate users not to open WAV files from untrusted sources
🧯 If You Can't Patch
- Run Premiere Rush with limited user privileges (not as administrator)
- Implement application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check Premiere Rush version in application (Help > About Premiere Rush). If version is 1.5.16 or earlier, system is vulnerable.Check Version:
Windows: Check application version in Help > About. macOS: Check application version in Premiere Rush > About Premiere Rush.Verify Fix Applied:
Verify version is 1.5.17 or later after update installation.📡 Detection & Monitoring
Log Indicators:
- Application crashes when processing WAV files
- Unusual process creation from Premiere Rush
Network Indicators:
- Outbound connections from Premiere Rush to unusual destinations
SIEM Query:
process_name:"Premiere Rush.exe" AND (event_type:crash OR parent_process:unusual)