Adobe After Effects versions 25.6 and earlier are susceptible to a critical Use After Free vulnerability that may allow attackers to achieve arbitrary code execution.

The software contains a Use After Free vulnerability (CWE-416) that can be triggered when a user opens a specially crafted malicious file, allowing an attacker to execute arbitrary code in the context of the current user. This vulnerability requires local user interaction, such as opening a file, to facilitate the exploit.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the victim, potentially leading to full system compromise or sensitive data theft. Given the CVSS score of 7.8, this represents a high-severity risk to organizational assets. The requirement for user interaction slightly offsets the urgency, but the potential for total impact necessitates immediate patching.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later, as provided in the vendor security bulletin.

Proactive Monitoring: Monitor endpoint activity for unexpected child processes spawned by the After Effects application, particularly following the opening of untrusted files.

Compensating Controls: Implement endpoint protection solutions that scan incoming files for malicious patterns and restrict the execution of untrusted files within the After Effects environment.

Public Exploit Available: No (exploit_available is false).

The vulnerability presents a significant risk to workstations where Adobe After Effects is installed. Administrators should prioritize the deployment of the vendor-supplied security updates to all affected systems to eliminate the risk of arbitrary code execution. Users should be advised to exercise caution when opening files from untrusted or unknown sources until the patching process is complete.