Product:
After Effects
Summary
After Effects versions 26.0, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.8 | CVE-2026-34643 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim in After Effects, triggers the out-of-bounds write condition. This requires the victim to be tricked into opening the file, leading to arbitrary code execution with the privileges of the current user.
Affected Products
- After Effects 26.0: The latest version affected by the vulnerability.
- After Effects 25.6.4: An earlier version that is also vulnerable.
Mitigation
Users are advised to avoid opening files from untrusted sources and to update to the latest version of After Effects as soon as a patch is available to mitigate the risk of exploitation.