What is the CVSS score of CVE-2026-34642?

CVE-2026-34642 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe After Effects are affected by CVE-2026-34642?

Adobe After Effects versions 26.0 and 25.6.4 and earlier contain a heap-buffer vulnerability enabling arbitrary code execution through malicious media files, directly exposing creative workstations…

How to fix or mitigate CVE-2026-34642?

Immediate (24 hours): Inventory all After Effects installations and implement strict file-source validation policies restricting project/media file opening to explicitly trusted internal and pre-approved supplier sources; issue a mandatory security advisory to creative teams prohibiting unsolicited file opening. Within 7 days: Deploy email and file scanning targeting After Effects project files, disable external macro/script execution where operationally feasible, and establish rapid-deployment procedures for vendor patches. Within 30 days: Establish weekly monitoring of APSB26-48 advisory and maintain patch-deployment readiness; upon vendor patch availability, expedite deployment to all affected installations ahead of standard patch cycles.

Adobe After Effects CVE-2026-34642

EUVD-2026-29613 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-05-12 adobe

GHSA-prfh-2953-xxp9

RCE Buffer Overflow Heap Overflow Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open bug so AV:L and UI:R; no prior privileges needed (PR:N) and straightforward parsing trigger (AC:L); arbitrary code execution yields full C/I/A within the user context.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:24 vuln.today

CVE Published

May 12, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

After Effects versions 26.0, 25.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and earlier arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted project or media file, letting an attacker run code in the context of the current user. Adobe self-reported the issue and released a patch via advisory APSB26-48. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with SSVC marking exploitation as 'none'.

Technical ContextAI

After Effects is Adobe's professional motion-graphics and visual-effects compositing application, which parses a wide range of project files (.aep) and imported media assets. The root cause is CWE-122, a heap-based buffer overflow, in which the application writes past the bounds of a heap-allocated buffer - typically because a length or size field taken from an attacker-controlled file is not validated against the actual allocation before copying data. The affected CPE is cpe:2.3:a:adobe:after_effects, and the corruption of heap metadata or adjacent objects can be groomed into control-flow hijacking, yielding arbitrary code execution with the privileges of the user running After Effects.

RemediationAI

Patch available per vendor advisory: update Adobe After Effects to the fixed release listed in Adobe APSB26-48 (https://helpx.adobe.com/security/products/after_effects/apsb26-48.html) via the Creative Cloud desktop app, as versions 26.0 and 25.6.4 and earlier are vulnerable; the advisory contains the exact fixed build numbers, which should be confirmed there before deployment. Because exploitation requires opening a malicious file, the most effective compensating control until patching is to restrict which project and media files users open - only open .aep projects and assets from trusted sources, avoid double-clicking files received by email or downloaded from untrusted sites, and consider blocking or quarantining inbound After Effects project files at the mail/web gateway (trade-off: may interrupt legitimate collaboration workflows that exchange project files). Running After Effects as a standard (non-administrator) user limits the blast radius to the current user's context (trade-off: minimal, and recommended regardless).