Adobe After Effects versions 25.6 and earlier are susceptible to a use after free vulnerability that could lead to arbitrary code execution.

This is a use after free vulnerability (CWE-416) triggered when a user opens a specially crafted malicious file. Successful exploitation allows an attacker to achieve arbitrary code execution in the context of the current user.

The potential for arbitrary code execution poses a significant risk to organizational assets, as it could allow unauthorized control over the affected workstation. Given the CVSS score of 7.8, this vulnerability is classified as High severity. An exploit could lead to full system compromise, data exfiltration, or the deployment of further malicious payloads within the environment.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later to address the vulnerability.

Proactive Monitoring: Monitor endpoint activity for unexpected process execution or abnormal behavior originating from the After Effects application.

Compensating Controls: Ensure that users maintain strict security hygiene by not opening untrusted files from unknown sources, as user interaction is required for successful exploitation.

Public Exploit Available: Unknown.

Organizations should prioritize the deployment of the provided security updates across all affected Adobe After Effects installations. Given the severity of arbitrary code execution flaws, timely patching is essential to prevent potential system compromise and ensure the integrity of the local environment.