What is the CVSS score of EUVD-2026-44467?

EUVD-2026-44467 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe After Effects are affected by EUVD-2026-44467?

CVE-2026-48367 in Adobe After Effects enables arbitrary code execution when users open malicious project files, directly threatening creative teams and organizational media assets with compromise.

How to fix or mitigate EUVD-2026-44467?

Within 24 hours: audit all Adobe After Effects installations; restrict project file access to verified internal sources and disable external media auto-loading. Within 7 days: deploy endpoint detection and response (EDR) monitoring for suspicious After Effects process spawning and file operations; conduct mandatory user training on file origin verification and suspicious project indicators. Within 30 days: establish daily monitoring of Adobe advisory APSB26-78; apply and validate patches immediately upon vendor release across all After Effects deployments; audit and isolate any externally-sourced project files received prior to patch availability.

Adobe After Effects EUVD-2026-44467

| CVE-2026-48367 HIGH

Out-of-bounds Write (CWE-787)

2026-07-14 adobe

GHSA-fhjh-7fwr-rp99

RCE Buffer Overflow Memory Corruption Adobe After Effects

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file-open exploitation gives AV:L and UI:R with no attacker auth (PR:N); memory-corruption RCE in the user context yields full C/I/A impact with unchanged scope.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 21:16 vuln.today

CVE Published

Jul 14, 2026 - 20:07 cve.org

HIGH 7.8

DescriptionCVE.org

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe After Effects arises from an out-of-bounds write (CWE-787) that runs in the context of the current user when a victim opens a maliciously crafted project or media file. Adobe (via advisory APSB26-78) confirms the flaw; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The 7.8 CVSS reflects high impact tempered by the local vector and required user interaction.

Technical ContextAI

After Effects is Adobe's professional motion-graphics and visual-effects compositing application, which parses a wide range of project (.aep) and imported media/asset formats. The root cause is CWE-787 (out-of-bounds write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - typically due to insufficient validation of length or index fields inside a maliciously structured file. The affected CPE is cpe:2.3:a:adobe:after_effects (version wildcarded in the provided data), indicating the file-parsing/decoding code path rather than a network service. A controlled out-of-bounds write can corrupt adjacent heap structures and be leveraged into control-flow hijack, yielding code execution with the privileges of the user running After Effects.

RemediationAI

Apply the update referenced in Adobe advisory APSB26-78 (https://helpx.adobe.com/security/products/after_effects/apsb26-78.html) via the Creative Cloud desktop app or Adobe's update mechanism - the exact fixed version number is not included in the provided data and should be taken from that advisory. As Patch available per vendor advisory, upgrading is the primary and preferred fix. Until updates are deployed, reduce exposure by not opening After Effects project or media files from untrusted or unsolicited sources, restricting where such files can originate (e.g., only from vetted internal pipelines), and running After Effects under a least-privileged user account so that code execution in the current-user context does not equate to administrative compromise; the trade-off is workflow friction for artists who exchange project files externally.