Executive brief
Adobe After Effects, a professional video editing and visual effects application, is affected by a security vulnerability that could allow an attacker to take control of a user's system. To exploit this, an attacker must trick a user into opening a specially crafted malicious file. Successful exploitation could lead to unauthorized software installation, data theft, or complete system compromise in the context of the logged-in user.
Technical details
A heap-based buffer overflow vulnerability (CWE-122) exists in Adobe After Effects versions 26.0, 25.6.4 and earlier. The flaw is triggered when the application improperly handles memory allocation while processing a malformed file. An attacker can exploit this by providing a crafted file that, when opened by a user, overflows the heap memory to execute arbitrary code with the privileges of the current user. The attack vector is local, requiring the victim to download and manually open the malicious file (User Interaction required). Adobe has addressed this in newer versions, and users are advised to update to the latest patched release.
Affected products
- Adobe After Effects 26.0, 25.6.4 and earlier
Timeline
- 2026-05-12: disclosed
- 2026-05-12: advisory