After Effects versions 26.0, 25.6.4 and earlier contain an integer overflow or wraparound flaw (CWE‑190) that can lead to arbitrary code execution in the context of the user who opens a malicious file. If exploited, the attacker would execute code with the victim’s privileges, potentially compromising the confidentiality, integrity, or availability of the affected system.

Adobe After Effects 26.0, 25.6.4, and all earlier releases on Windows, macOS, and other supported platforms are affected. The vulnerability applies only to the After Effects application; it does not extend to other Adobe products.

The CVSS score of 7.8 denotes high severity. EPSS score is not provided, so the exact probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that a user must open a malicious file; this is inferred from the requirement for user interaction. Because user interaction is required, the risk is higher in environments where users frequently work with external projects.