Product:
After Effects
Summary
After Effects versions 25.6 and earlier are affected by a Type Confusion vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically that a victim must open a malicious file. This vulnerability poses significant risks to confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-21330 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious file that, when opened by the victim using After Effects, triggers the type confusion. This allows the attacker to execute arbitrary code within the context of the current user, potentially leading to unauthorized access and control over the user’s system.
Affected Products
- After Effects 25.6 and earlier: Vulnerable to type confusion leading to arbitrary code execution.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure they are using the latest version of After Effects. Regularly updating software can help protect against known vulnerabilities.