Adobe After Effects is vulnerable to arbitrary code execution through an out-of-bounds write flaw that requires user interaction to trigger.

This vulnerability is an out-of-bounds write (CWE-787) occurring within the application. It allows a local attacker to execute arbitrary code in the context of the current user if they successfully trick a victim into opening a specially crafted malicious file.

Successful exploitation of this vulnerability could lead to a full compromise of the user account running the application, potentially resulting in data exfiltration or lateral movement within the network. With a CVSS score of 7.8, this represents a high-severity risk, particularly in creative environments where external files are frequently opened and processed.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later to apply the necessary security fixes.

Proactive Monitoring: Monitor endpoint logs for suspicious process spawning or unexpected file system modifications initiated by the After Effects application.

Compensating Controls: Implement strict email and file transfer policies to prevent users from opening untrusted or unsolicited project files from unknown sources.

Public Exploit Available: No (exploit_available: false).

Given the high CVSS severity and the potential for arbitrary code execution, administrators should prioritize the deployment of the vendor-provided updates across all workstations utilizing Adobe After Effects. Ensuring that users are trained to verify the origin of files before opening them remains a critical defensive layer against this and similar file-parsing vulnerabilities.