After Effects
CVE-2026-21327
HIGH
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe After Effects 25.6 and earlier through out-of-bounds write vulnerability (CWE-787) when processing malicious files. An attacker can execute code with user privileges by convincing a victim to open a specially crafted file, with no patch currently available.
Technical ContextAI
Classified as CWE-787 (Out-of-bounds Write). Affects After Effects. After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
RemediationAI
Monitor vendor advisories for a patch. Enable ASLR, DEP/NX, and stack canaries where possible.
More in After Effects
View allAdobe After Effects versions 16.1.2 and earlier have an out-of-bounds write vulnerability. Rated critical severity (CVSS
Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained w
Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. Rated h
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result i
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result i
After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that cou
After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result i
After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could re
Arbitrary code execution in Adobe After Effects 25.6 and earlier results from an out-of-bounds read vulnerability trigge
Code execution in Adobe After Effects 25.6 and earlier through out-of-bounds memory reads when processing malicious file
Out-of-bounds memory reads in Adobe After Effects 25.6 and earlier enable arbitrary code execution when users open speci
Arbitrary code execution in Adobe After Effects 25.6 and earlier through a use-after-free memory vulnerability requires
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today