CVE-2026-21328 is an out-of-bounds write vulnerability present in Adobe After Effects versions 25.6 and earlier. The flaw allows an attacker to corrupt memory when parsing a malicious file, leading to arbitrary code execution in the user’s context. The primary impact is that a specially crafted After Effects project can execute code on the target system without requiring elevated privileges.

Affected products include Adobe After Effects on both macOS and Windows platforms. Versions 25.6 and earlier are vulnerable. No specific operating‑system version is restricted; the vulnerability exists across all supported OS releases listed in the CPE entries.

The vulnerability carries a CVSS score of 7.8, indicating high damage potential, while the EPSS score is reported as less than 1%, and it is not listed in the CISA KEV catalog. Exploitation requires user interaction: the victim must open a malicious After Effects file. The likely attack vector is social engineering in which a user receives and opens a file from an untrusted source, triggering the memory corruption and code execution. Because the flaw is triggered only during file parsing, remote exploitation without user action is not feasible.