Adobe After Effects versions 25.6 and earlier are vulnerable to an integer overflow flaw that can lead to arbitrary code execution upon opening a malicious file.

The software is susceptible to an integer overflow or wraparound vulnerability (CWE-190). An attacker can trigger this flaw to achieve arbitrary code execution in the context of the current user, provided the victim opens a specially crafted malicious file.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running After Effects. Given the CVSS score of 7.8, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, or the deployment of additional malicious payloads within the corporate environment.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later to incorporate the vendor security fixes.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected file system modifications initiated by After Effects.

Compensating Controls: Implement file integrity monitoring and restrict the execution of untrusted media files from unknown or external sources.

Public Exploit Available: No confirmed public exploit available.

This vulnerability presents a high risk to organizational security due to the potential for arbitrary code execution. IT administrators should prioritize the deployment of the provided vendor updates across all workstations utilizing Adobe After Effects. Users should be cautioned against opening suspicious project files from unverified sources until the patch is applied.