A Use After Free flaw in Adobe After Effects versions 25.6 and earlier could allow an attacker to cause the application to execute arbitrary code while a user opens a malicious file. The vulnerability is a classic heap‑memory error that results in a local privilege escalation within the user context. An attacker who succeeds can run code as the victim with the same permissions as the user.

The issue affects Adobe After Effects on all platforms, including macOS, Windows, and potentially other operating systems supported by the application. Any installation of After Effects version 25.6 or older is vulnerable, regardless of operating system version.

The CVSS base score of 7.8 reflects a moderate to high severity, while the EPSS score of less than 1% indicates a very low probability of exploitation at this time. The vulnerability requires user interaction in that the victim must open a crafted file, limiting remote exploitation. Because it is not currently listed in CISA’s KEV catalog, no widespread active exploitation has been documented. Nevertheless, the combination of high impact and the need for user action means it remains a high risk for environments where users may unknowingly open malicious media.