Adobe After Effects versions 25.6 and earlier contain a type confusion flaw (CWE‑843) that allows an attacker to execute arbitrary code in the context of the current user. The vulnerability is triggered when a maliciously crafted project file is opened, leading the application to treat an incompatible data type and write unintended data, thereby granting code execution privileges.

The flaw affects all installations of Adobe After Effects version 25.6 and older on macOS and Windows platforms. Any user running these versions who opens a malicious or tampered After Effects file is susceptible to exploitation.

With a CVSS score of 7.8 the vulnerability is classified as high severity, and the EPSS score of less than 1 percent suggests a low but non‑zero probability of exploitation in the wild. Exploitation requires user interaction to open a malicious file, making social engineering or targeted attacks the most likely vectors. The vulnerability is not currently listed in the CISA KEV catalog, but it remains a known risk until the published update is applied.