Product:
After Effects
Summary
After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file. This could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user, requiring user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-21325 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using After Effects, triggers the out-of-bounds read. This requires the victim to be tricked into opening the file, allowing the attacker to execute code with the same privileges as the user.
Affected Products
- After Effects versions 25.6 and earlier: Vulnerable to out-of-bounds read when parsing crafted files.
Mitigation
Users are advised to avoid opening untrusted files in After Effects and to update to the latest version to mitigate the risk of exploitation. Regularly checking for updates and applying security patches can help protect against this vulnerability.