After Effects versions up to and including 25.6 contain a null pointer dereference that, when triggered by a malicious file, can cause the application to crash. The vulnerability is identified as CWE-476 and does not provide remote code execution but results in an application denial of service and potential loss of unsaved work.

Adobe After Effects users on Apple macOS and Microsoft Windows are impacted. All builds of version 25.6 and earlier are vulnerable; any installation not updated past 25.6 is considered at risk.

The CVSS score of 5.5 reflects moderate risk while an EPSS score of less than 1% indicates a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploits. Exploitation requires a victim to open a crafted file, so the threat is limited to users handling untrusted media files, but the attack path is simple and does not need elevated privileges.