What is the CVSS score of CVE-2026-34644?

CVE-2026-34644 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe After Effects are affected by CVE-2026-34644?

Adobe After Effects versions 26.0 and earlier contain an arbitrary code execution vulnerability triggered when users open maliciously crafted project files, directly compromising the confidentiality…

How to fix or mitigate CVE-2026-34644?

Within 24 hours, inventory your environment using endpoint management or license compliance tools to identify all deployments of Adobe After Effects versions 26.0, 25.6.4, and earlier, and issue guidance to affected teams prohibiting the opening of After Effects files (.aep, .aet) from untrusted or unexpected external sources. Within 7 days, configure your email security gateway to block inbound After Effects project files from external domains, implement this file-type restriction at the endpoint via group policy or mobile device management, and conduct brief security awareness training for creative staff emphasizing social engineering vectors targeting file-based attacks. Within 30 days, establish a monitoring cadence for Adobe's security advisory pages to detect patch availability, prepare and test a deployment plan for immediate rollout to After Effects 26.1 or later once released, and evaluate whether virtualized or air-gapped processing of external After Effects files or alternative design tools could supplement your production environment.

Adobe After Effects CVE-2026-34644

EUVD-2026-29615 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-05-12 adobe

GHSA-h9wf-3mw4-4mx9

RCE Integer Overflow Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open delivery gives AV:L and UI:R with no prior privileges (PR:N); reliable single-file trigger yields AC:L, and code execution as the user gives full C/I/A:H.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 23:23 vuln.today

CVE Published

May 12, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

After Effects versions 26.0, 25.6.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects (versions 26.0, 25.6.4 and earlier) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file that triggers an integer overflow (CWE-190). Only user-assisted local exploitation is possible (CVSS 7.8, AV:L/UI:R), there is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with SSVC 'Exploitation: none'.

Technical ContextAI

After Effects is Adobe's professional motion-graphics and visual-effects compositing application, which parses a wide range of complex media, project, and asset file formats. The root cause is CWE-190 (Integer Overflow or Wraparound): during parsing of attacker-controlled file data, an arithmetic operation - typically a size, count, or offset calculation - wraps around its integer bounds, producing an undersized allocation or incorrect index that leads to out-of-bounds memory access and ultimately corrupts memory in a way that yields control of execution. The affected product is identified in CPE as cpe:2.3:a:adobe:after_effects, and the memory-corruption primitive runs with the privileges of the user who opened the file.

RemediationAI

Apply the vendor patch: upgrade Adobe After Effects to the fixed release published in Adobe security bulletin APSB26-48 (https://helpx.adobe.com/security/products/after_effects/apsb26-48.html), which supersedes the vulnerable 26.0 and 25.6.4 and earlier builds; consult that bulletin for the exact patched version number, as the specific fixed build is not independently confirmed in the provided data. Until updating, reduce exposure by treating After Effects project and asset files from untrusted or unsolicited sources as dangerous and not opening them, and by restricting which files reach editing workstations (for example blocking or quarantining project files delivered by email or download); the trade-off is added friction to legitimate collaboration workflows that routinely exchange project files. There is no network service to firewall, so file-handling discipline and prompt patching are the effective controls.