Adobe After Effects versions 25.6 and earlier are susceptible to an out-of-bounds read vulnerability that could lead to arbitrary code execution if a user opens a malicious file.

This is an out-of-bounds read vulnerability (CWE-125) triggered when the software parses a specially crafted file. Successful exploitation allows an attacker to execute code in the context of the current user, provided the user interacts with the malicious file.

This vulnerability carries a CVSS score of 7.8, indicating a high severity risk. Successful exploitation could lead to full system compromise or unauthorized access to sensitive data within the user's environment, resulting in significant operational disruption and potential reputational damage.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later to apply the necessary security fixes.

Proactive Monitoring: Monitor workstation endpoint logs for abnormal application crashes or unexpected child processes spawned by Adobe After Effects.

Compensating Controls: Ensure that endpoint protection software is active and configured to scan files upon access or execution to detect malicious payloads.

Public Exploit Available: exploit_available (false)

Given the high CVSS score and the potential for arbitrary code execution, administrators should prioritize updating all instances of Adobe After Effects to the patched versions. Users should be cautioned against opening untrusted files, but patching remains the only reliable method to mitigate the underlying memory corruption risk.