A crafted After Effects file can trigger an out‑of‑bounds read that allows an attacker to execute code within the context of the current user. The vulnerability is caused by improper bounds checking during file parsing and only results in memory reads beyond the allocated structure. Successful exploitation requires user interaction: the victim must open the malicious file, after which arbitrary code can be executed with the victim’s privileges.

Adobe After Effects versions 25.6 and earlier on macOS and Windows are affected. The issue is present in all builds of these versions on the listed operating systems.

The vulnerability has a high CVSS score of 7.8, but the EPSS score is less than 1 % indicating a low probability of widespread exploitation. It is not currently listed in CISA’s KEV catalog. To exploit it, an attacker must obtain or convince a user to open a malicious file; there is no remote network component. The vulnerability is therefore local and requires user interaction.