A critical type confusion vulnerability in Adobe After Effects 25.6 and earlier versions allows for arbitrary code execution if a user opens a malicious file.

This vulnerability is a type confusion flaw (CWE-843) that occurs when the application incorrectly handles object types. An attacker can trigger this condition by convincing a victim to open a malicious file, leading to arbitrary code execution in the context of the current user.

The potential for arbitrary code execution poses a severe risk to organizational security, as it allows attackers to gain control over the victim's workstation. With a CVSS score of 7.8, this high-severity vulnerability could lead to the theft of sensitive data, installation of malware, or unauthorized lateral movement within the network.

Immediate Action: Update Adobe After Effects to version 25.6.4, 26.0, or later to incorporate the necessary security patches.

Proactive Monitoring: Monitor endpoint activity for suspicious file-opening events or unusual process execution patterns associated with After Effects.

Compensating Controls: Use application control policies to restrict the execution of untrusted files and ensure that users are trained to avoid opening unexpected or suspicious project files from unknown sources.

Public Exploit Available: No (exploit_available: false)

Given the potential for arbitrary code execution, this vulnerability represents a significant security risk to all environments running affected versions of Adobe After Effects. Organizations should prioritize updating to the latest patched versions immediately to eliminate the threat of exploitation.