Adobe After Effects is affected by a critical out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code on a victim machine.

This vulnerability is an out-of-bounds write (CWE-787) flaw triggered when a user opens a malicious file, requiring user interaction to execute. The attacker does not require pre-existing authentication to the system to exploit this condition.

The potential for arbitrary code execution poses a significant risk to organizational assets, as a successful exploit could grant an attacker the same privileges as the victim, leading to full system compromise. With a CVSS score of 7.8, this high-severity vulnerability could facilitate data exfiltration, lateral movement within the network, or the deployment of ransomware, resulting in severe operational disruption.

Immediate Action: Update Adobe After Effects to version 25.6.4 or 26.0 immediately to apply the vendor-provided security patches.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected file system modifications initiated by the After Effects application.

Compensating Controls: Implement file integrity monitoring and ensure that users exercise caution when opening files from untrusted or unknown sources to limit the exposure to malicious payloads.

Public Exploit Available: exploit_available (false)

Given the severity of this vulnerability and the potential for arbitrary code execution, it is imperative that all affected systems are patched to the latest version immediately. Organizations should prioritize this update for all workstations running the Adobe After Effects software to mitigate the risk of compromise.