Adobe After Effects versions 25.6 and earlier contain a use‑after‑free vulnerability that can allow an attacker to execute code as the currently logged‑in user. The flaw stems from a failure to nullify a memory reference after it has been freed, enabling the invocation of corrupted data. Such an exploitation can compromise confidentiality, integrity, or availability of the host system if the attacker controls the executed payload.

The vulnerability affects Adobe After Effects 25.6 and earlier across macOS and Windows platforms, as indicated by the associated Adobe after effects CPE and generic operating‑system CPEs for Apple macOS and Microsoft Windows.

The CVSS score of 7.8 indicates a serious risk, while the EPSS score of < 1 % suggests a low likelihood of widespread exploitation at present. The flaw is not catalogued in the CISA KEV list. Exploitation requires user interaction: a victim must open a malicious file crafted to trigger the use‑after‑free. The attack vector is therefore likely via the file‑open process, such as opening a tailored project file within After Effects.