What is the CVSS score of CVE-2026-34643?

CVE-2026-34643 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe After Effects are affected by CVE-2026-34643?

Adobe After Effects versions 26.0 and 25.6.4 and earlier contain a code execution vulnerability triggered by opening malicious files, exposing design teams and their systems to compromise.

How to fix or mitigate CVE-2026-34643?

Within 24 hours, inventory all Adobe After Effects deployments to identify instances of versions 26.0, 25.6.4, and earlier, cross-referencing APSB26-48 to confirm exposure scope. Within 7 days, procure and deploy the patched release from Adobe's APSB26-48 advisory to all affected systems, prioritizing users with access to sensitive creative assets. Within 30 days, verify patch coverage across the environment and implement file-source controls to restrict opening untrusted files in After Effects.

Adobe After Effects CVE-2026-34643

EUVD-2026-29614 HIGH

Out-of-bounds Write (CWE-787)

2026-05-12 adobe

GHSA-26xr-9fhj-5xq3

RCE Buffer Overflow Memory Corruption Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open attack (AV:L, UI:R) with no attacker privileges (PR:N); successful code execution yields full user-context compromise, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:23 vuln.today

CVE Published

May 12, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%), but the CVSS 3.1 base score is 7.8 (High) with total technical impact. Adobe has published a patch in advisory APSB26-48.

Technical ContextAI

Adobe After Effects is a widely used motion-graphics and visual-effects compositing application (cpe:2.3:a:adobe:after_effects). The root cause is an out-of-bounds write (CWE-787), a memory-corruption class in which the application writes past the bounds of an allocated buffer - typically while parsing untrusted media, project, or asset file structures. Controlled out-of-bounds writes can overwrite adjacent heap metadata, function pointers, or object data, which is the classic primitive for achieving arbitrary code execution. The tags (Memory Corruption, Buffer Overflow, RCE) and SSVC 'Technical Impact: total' rating are consistent with a full memory-corruption-to-code-execution chain within the parsing logic of a specific file format handled by After Effects.

RemediationAI

Apply the vendor-released patch from Adobe advisory APSB26-48 (https://helpx.adobe.com/security/products/after_effects/apsb26-48.html) by upgrading After Effects to the fixed release listed there for both the 26.x and 25.6.x branches - the exact fixed build should be taken from that advisory, as versions 26.0, 25.6.4 and earlier are vulnerable. Until patching is complete, reduce exposure by treating After Effects project files and imported media from untrusted or unsolicited sources as dangerous: do not open files received via email or download from unknown parties, and consider restricting file-association handling so After Effects does not auto-open assets. Because exploitation requires opening a malicious file, user-awareness training and blocking inbound delivery of project/asset files at the mail gateway are effective compensating controls; the trade-off is workflow friction for teams that legitimately exchange After Effects assets externally.