An out-of-bounds write in Adobe After Effects allows a malicious document to overwrite memory, which can be leveraged to run arbitrary code under the victim’s user context. The vulnerability exists in versions 26.0, 25.6.4, and older releases. Because the flaw requires the user to open a crafted file, exploitation depends on user interaction. If successful, an attacker could gain control over the affected system, execute arbitrary commands, or install malware.

Adobe After Effects 26.0, 25.6.4, and all older versions.

The CVSS score of 7.8 denotes high risk; the absence of an EPSS score means no current exploit probability is reported, and the vulnerability is not listed in CISA's KEV catalog. Attackers must convince a user to open a malicious file, so exploitation requires user interaction. If the attack succeeds, the attacker can execute code with the user's privileges. The high severity combined with the need for user action suggests a moderate to high exploitation likelihood in environments where users routinely open untrusted files.