Adobe After Effects versions 25.6 and earlier contain a Use After Free flaw that allows malicious input files to trigger unauthorized code execution in the victim’s user context. The vulnerability results from accessing memory that has already been freed by the software, a classic instance of the CWE-416 weakness. An attacker must supply a specially crafted file that the application processes, and the exploit is only possible when a user opens that file, meaning the threat is primarily driven by user interaction.

The flaw affects Adobe After Effects on both Windows and macOS platforms. Vulnerable releases are all versions 25.6 and older; newer releases are not listed in the advisory. Users on either operating system who run the affected software are at risk if they open maliciously crafted media files.

The CVSS score of 7.8 indicates a high severity, yet the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. Because the flaw requires user interaction to open a malicious file, an attacker must target a specific user or perform spear‑phishing. The vulnerability is not currently cataloged as a known‑exploited vulnerability by CISA. The main risk lies in the potential for local privilege escalation or full control of the victim’s machine within their user session.