Adobe After Effects versions 25.6 and earlier suffer from a use‑after‑free vulnerability that allows an attacker to execute arbitrary code in the context of the user running the application. The flaw is classified under CWE‑416 and could lead to full compromise of the user’s machine if exploited. The impact is confined to the privileges of the logged‑in user but can be severe if the user has administrative or other elevated rights.

Adobe After Effects, available for both macOS and Windows platforms. Any installation of After Effects version 25.6 or earlier is affected, regardless of the operating system version or hardware.

The CVSS score of 7.8 signals a high severity, and the EPSS score of less than 1% indicates the vulnerability is currently under low exploitation probability. Because the vulnerability is only exploitable when a user opens a malicious file, the attack vector is user‑initiated and local, though it can lead to remote code execution within the user’s session if the user executes the file. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly reported exploitation has been confirmed yet. Still, the high CVSS and the nature of the flaw warrant prompt attention.