Adobe After Effects versions 25.6 and earlier are vulnerable to a critical Use After Free flaw that allows for arbitrary code execution upon opening a malicious file.

This vulnerability is a Use After Free (CWE-416) flaw triggered when the application processes a specially crafted file. Successful exploitation requires user interaction, specifically that an unauthenticated user or victim must open the malicious file within the application.

The potential for arbitrary code execution poses a significant risk to organizational integrity and confidentiality. By leveraging this vulnerability, an attacker can execute code in the context of the current user, potentially leading to unauthorized data access or complete system compromise. With a CVSS score of 7.8, this vulnerability is classified as High severity, necessitating prompt remediation to prevent weaponization within the local environment.

Immediate Action: Update Adobe After Effects to version 25.6.4 or 26.0 immediately to apply the vendor-supplied security fixes.

Proactive Monitoring: Review system logs for unusual application crashes or unexpected file access patterns that may indicate an attempt to trigger memory corruption vulnerabilities.

Compensating Controls: Implement endpoint protection solutions that scan incoming files for malicious signatures and restrict the ability of untrusted users to open files from unknown or external sources.

Public Exploit Available: exploit_available (false)

Given the potential for arbitrary code execution, this vulnerability represents a significant risk to the security of the host workstation. Administrators should prioritize the deployment of the patches provided by Adobe to versions 25.6.4 or 26.0 across all affected systems. Failure to patch leaves the environment susceptible to malicious file-based attacks that could bypass existing security controls.