Adobe After Effects versions 25.6 and earlier contain a Use After Free vulnerability that can allow an attacker to run arbitrary code in the context of the current user. This flaw arises when the application processes a maliciously crafted file, leading to an attempt to use memory that has already been freed. The resulting loss of control over memory can be leveraged to compromise the system or perform unauthorized actions.

The flaw affects Adobe After Effects on supported operating systems, including Microsoft Windows and Apple macOS, for all releases up to and including version 25.6. Users of these versions can be exposed if they open infected After Effects project files on their machines.

The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is below 1%, showing that the overall probability of exploitation is low at present, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires user interaction; the attacker must convince a victim to open a crafted After Effects file. When this condition is met, the attacker can achieve full code execution with the privileges of the user who opened the file.