CVE-2026-34690: Adobe After Effects stack-based buffer overflow

CVE-2026-34690 · Severity: high · CVSS 7.8 · Published 2026-05-12

Adobe After Effects, a professional video editing and visual effects application, is vulnerable to a security flaw when processing specially crafted files. If a user is tricked into opening a malicious file, an attacker could gain the ability to execute unauthorized commands on the user's computer. This could lead to a full system compromise, data theft, or the installation of malware in the context of the logged-in user.

Technologies: Adobe After Effects. Vendors: Adobe.

Quick answers

Is CVE-2026-34690 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-34690 being exploited in the wild.
How severe is CVE-2026-34690?
High severity, with a CVSS score of 7.8, published 12 May 2026.
Which products and versions are affected?
Adobe After Effects <= 25.6.5, 26.0 to <= 26.2.1, 26.0, 25.6.4 and earlier.
Is there a fix for CVE-2026-34690?
A patch was published on 2026-07-14: Updated advisory and version information provided by vendor Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34690 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-34690?
Check whether you run Adobe After Effects at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stack-based buffer overflow (CWE-121) exists in Adobe After Effects versions 25.6.5, 26.2.1, and earlier. The vulnerability is triggered when the application improperly handles memory while parsing a specially crafted file. An attacker can exploit this by convincing a user to open a malicious project or asset file, leading to arbitrary code execution in the context of the current user. The attack vector is local (AV:L) and requires user interaction (UI:R). Adobe has released security updates (APSB26-78) to address this issue in versions 25.6.6 and 26.3.

Affected products

  • Adobe After Effects <= 25.6.5, 26.0 to <= 26.2.1

Timeline

  • 2026-05-12: disclosed
  • 2026-05-12: advisory: Initial advisory published by Adobe
  • 2026-07-14: patched: Updated advisory and version information provided by vendor

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.