Technical impact
After Effects versions 26.0, 25.6.4 and earlier contain a heap-based buffer overflow that allows an attacker to execute arbitrary code within the context of the currently logged‑in user. The flaw arises when processing a maliciously crafted file and can compromise confidentiality, integrity, and availability of the user’s data and the system as a whole. The weakness is classified as CWE‑122.
Affected Systems
Adobe After Effects, including all releases up to and including 26.0 and 25.6.4. Users running these affected versions are vulnerable and must update to a later release that removes the heap overflow.
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity potential for exploitation. No EPSS value is available, leaving the precise likelihood uncertain, but the issue is not listed in the CISA KEV catalog at this time. Based on the description, the attack vector requires a victim to open a malicious file, so the vulnerability is exploitable through user interaction, typically via social engineering or malicious media files. If executed, an attacker can gain code execution authority within the user’s session, potentially leading to system compromise.
