---
id: "CVE-2026-113512"
page: "https://infrastack.ai/live/CVE-2026-113512"
kind: "vulnerability"
aliases: ["CVE-2026-113512"]
title: "Adobe After Effects: stack buffer overflow lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "After Effects", "fixed": ["27.0", "26.5.3"], "affected": "<= 26.5, <= 25.6.6 (Windows and macOS)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-after-effects", "creative-workstations", "macos", "other", "user-interaction", "windows"]
not_affected_if: ["after-effects-26.5.3-or-later", "after-effects-27.0-or-later", "no-after-effects-installed"]
published_at: "2026-11-10T21:18:42+00:00"
first_seen_at: "2026-11-10T21:46:09+00:00"
updated_at: "2026-11-10T22:01:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113512", "first_seen_at": "2026-11-10T21:46:09+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html", "first_seen_at": "2026-11-10T22:01:25+00:00", "cites": ["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}]
exploit_sources: []
---

# Adobe After Effects: stack buffer overflow lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-113512 (this .md is for agents)

Adobe After Effects has a stack-based buffer overflow that can be triggered by opening a malicious file. A successful attack can run arbitrary code with the privileges of the current user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5, <= 25.6.6 (Windows and macOS) fixed 27.0, 26.5.3

## How to check

Open After Effects > About After Effects (or the Creative Cloud app) and read the version. Exposed if it is 26.5 or earlier (fixed in 26.5.3), or 25.6.6 or earlier. Fixed: 27.0 or 26.5.3.

## Fix

Update Adobe After Effects to 27.0, or 26.5.3 on the 26.x line, via Creative Cloud desktop app or Download Center. Adobe's bulletin lists no fixed build for the 25.6 line; the affected range includes 25.6.6 and earlier, so move to 26.5.3 or 27.0.

## Timeline

- 2026-11-10T21:46:09+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113512
- 2026-11-10T22:01:25+00:00 analyst https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html — Read Adobe APSB26-100 (Nov 10 2026, priority 3): affected 26.5 and earlier / 25.6.6 and earlier; fixed 27.0 and 26.5.3; no exploitation known. Adobe does not list file types.

## Documents

- [advisory] Adobe APSB26-100: Security update available for Adobe After Effects https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html

## From the sources

After Effects is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_