Description
After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-02-10
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Apply patch
AI Analysis

Impact

An integer overflow or wraparound flaw exists in Adobe After Effects that allows a crafted file to corrupt internal counters and trigger execution of arbitrary code in the context of the user who opens the file.

Affected Systems

Adobe After Effects 25.6 and earlier are affected. The vulnerability can be triggered on Windows and macOS systems running the vulnerable versions of After Effects.

Risk and Exploitability

The flaw carries a CVSS score of 7.8, indicating high severity, but the EPSS score is below 1%, suggesting low exploitation probability. It is not listed in the CISA KEV catalog. Exploitation requires user interaction – a victim must open a malicious file – and thus depends on user behavior to launch the attack.

Generated by OpenCVE AI on April 18, 2026 at 12:48 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Adobe After Effects to version 26 or later to apply the vendor’s fix.
  • If an upgrade is not immediately possible, avoid opening any files from untrusted or unknown sources until the update is installed.
  • Run After Effects with the least privilege necessary, limiting the damage should an exploit succeed.

Generated by OpenCVE AI on April 18, 2026 at 12:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 26 Feb 2026 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 11 Feb 2026 17:45:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:after_effects:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Microsoft
Microsoft windows

Tue, 10 Feb 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe after Effects
Vendors & Products Adobe
Adobe after Effects

Tue, 10 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Description After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title After Effects | Integer Overflow or Wraparound (CWE-190)
Weaknesses CWE-190
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe After Effects
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-02-26T14:44:37.358Z

Reserved: 2025-12-12T22:01:18.193Z

Link: CVE-2026-21321

cve-icon Vulnrichment

Updated: 2026-02-25T15:42:30.308Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-10T18:16:29.627

Modified: 2026-02-11T17:37:29.543

Link: CVE-2026-21321

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:00:08Z

Weaknesses