What is the CVSS score of CVE-2026-34690?

CVE-2026-34690 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe After Effects are affected by CVE-2026-34690?

Adobe After Effects versions 26.0, 25.6.4 and earlier contain a stack-based buffer overflow vulnerability (CVE-2026-34690) that could allow attackers to execute arbitrary code on affected systems…

How to fix or mitigate CVE-2026-34690?

Within 24 hours, inventory all systems running Adobe After Effects versions 26.0, 25.6.4 or earlier and restrict opening of untrusted project and media files from external sources; implement user awareness communications regarding the risk. Within 7 days, monitor Adobe security advisories for APSB26-48 patch release and prepare patch deployment procedures; restrict After Effects use to files from trusted sources only and consider air-gapping systems if feasible. Within 30 days, deploy vendor patch immediately upon release and verify deployment across all affected systems; implement file validation and sandboxing controls to mitigate ongoing risk.

Adobe After Effects CVE-2026-34690

EUVD-2026-29783 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-05-12 adobe

GHSA-7cgm-hcwh-pj79

RCE Buffer Overflow Stack Overflow Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

File must be opened locally by a user (AV:L, UI:R) with no prior privileges (PR:N), and successful memory corruption yields full code execution (C:H/I:H/A:H).

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:40 vuln.today

CVE Published

May 12, 2026 - 19:26 nvd

HIGH 7.8

DescriptionCVE.org

After Effects versions 26.0, 25.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects 26.0, 25.6.4 and all earlier versions arises from a stack-based buffer overflow (CWE-121) triggered when a victim opens a maliciously crafted project or media file, running code in the context of the current user. Reported by Adobe and tracked in APSB26-48, it carries a CVSS 7.8 (High) with a local attack vector and required user interaction; there is no public exploit identified at time of analysis, and the EPSS score is 0.01% (1st percentile). SSVC indicates no observed exploitation but total technical impact, making this a patch-on-schedule priority rather than an emergency.

Technical ContextAI

After Effects is Adobe's professional digital motion-graphics and visual-effects compositing application. The root cause is CWE-121 (Stack-based Buffer Overflow): the affected component parses attacker-controlled file data (a project, footage, or media asset) and copies it into a fixed-size stack buffer without adequate bounds checking, allowing adjacent stack memory - including saved return addresses - to be overwritten. The single CPE cpe:2.3:a:adobe:after_effects:*:*:*:*:*:*:*:* covers the desktop application generically without narrowing by edition or platform. Because the corruption is on the stack, successful exploitation can hijack control flow and lead to arbitrary native code execution within the privileges of the user running After Effects.

RemediationAI

Apply the Adobe-released update for After Effects to a version newer than 26.0 / 25.6.4 as specified in the vendor bulletin at https://helpx.adobe.com/security/products/after_effects/apsb26-48.html; the input data does not state the exact fixed build number, so confirm the precise patched version directly from that advisory before deployment. Until patched, reduce exposure by treating After Effects project and media files from untrusted or unsolicited sources as dangerous - do not open them, and restrict which files reach workstations (email/download filtering, sandboxed review), since exploitation requires a user to open a malicious file. Running After Effects under a least-privileged, non-administrative user account limits the blast radius of code execution but does not prevent exploitation and may impede some plugin/workflow operations, a trade-off worth accepting on high-value hosts.