What is the CVSS score of CVE-2026-21351?

CVE-2026-21351 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of After Effects are affected by CVE-2026-21351?

Adobe After Effects versions 25.6 and earlier contain a use-after-free vulnerability that could allow attackers to execute arbitrary code on affected systems if users open malicious files.

How to fix or mitigate CVE-2026-21351?

Within 24 hours: Issue security advisory to all After Effects users warning against opening files from untrusted sources and disable After Effects if not critical to operations. Within 7 days: Implement file transfer controls to block suspicious After Effects project files at email and file-sharing gateways; isolate affected workstations on segmented networks. Within 30 days: Monitor Adobe's security bulletins for patch availability and establish a rapid deployment plan; consider upgrading to After Effects version 26.0+ if available as a workaround.

After Effects CVE-2026-21351

HIGH

Use After Free (CWE-416)

2026-02-10 psirt@adobe.com

RCE Denial Of Service Use After Free Memory Corruption Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.8

DescriptionCVE.org

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects 25.6 and earlier through a use-after-free memory vulnerability requires user interaction to open a specially crafted file. An attacker can exploit this flaw to execute malicious code with the privileges of the affected user. No patch is currently available.

Technical ContextAI

Classified as CWE-416 (Use After Free). Affects After Effects. After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.