{"id":"CVE-2026-113516","kind":"vulnerability","aliases":["CVE-2026-113516"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that can be triggered by opening a crafted file. A successful attack runs code with the privileges of the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-after-effects","creative-workstations","macos","package","windows"],"not_affected_if":["after-effects-27.0-or-26.5.3","no-after-effects-installed"],"how_to_check":"In After Effects open Help > About After Effects (Windows) or After Effects > About After Effects (macOS), or check the Creative Cloud desktop app. Affected: 26.5 and earlier, and 25.6.6 and earlier. Fixed: 26.5.3 and 27.0.","fix":"Update Adobe After Effects to 27.0, or 26.5.3 if staying on the 26.x line, via Creative Cloud desktop app or Download Center. Adobe lists no 25.x fix: the 25.6.6 line is affected, so move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","triaged_at":"2026-11-10T21:48:14+00:00","updated_at":"2026-11-10T22:01:18+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:48:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that can be triggered by opening a crafted file. A successful attack runs code with the privileges of the current user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["adobe-after-effects","creative-workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the user who opened the malicious file","analyst_note":"Check Adobe's security bulletin for affected and fixed After Effects versions and any patch for CVE-2026-113516.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-after-effects-installed"],"who_is_affected":"Teams that run Adobe After Effects on their workstations and open project or media files from outside sources. The sources do not list affected versions. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4521,"output_tokens":390,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Adobe's security bulletin for affected and fixed After Effects versions and any patch for CVE-2026-113516.","search":"'-113516':17A,20A '-2026':16A,19A 'adob':1A,24B,33B 'adobe-after-effect':23B 'affect':68C 'after':21A 'arbitrari':81C 'attack':55B 'bound':7A,41B,74C 'code':14A,57B,82C 'context':86C 'could':78C 'craft':51B 'creativ':28B 'creative-workst':27B 'current':63B,89C 'cve':15A,18A 'effect':3A,26B,35B,66C 'effects':22A 'execut':83C 'exploit':91C 'file':12A,52B,106C 'flaw':43B 'interact':97C 'issu':94C 'let':9A 'maco':30B 'malici':11A,105C 'must':102C 'open':49B,103C 'out-of-bound':4A,38B,71C 'packag':31B 'privileg':60B 'requir':95C 'result':79C 'run':13A,56B 'success':54B 'trigger':47B 'user':64B,90C,96C 'victim':101C 'vulner':76C 'window':32B 'workstat':29B 'write':8A,42B,75C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects 26.5 or earlier, or 25.6.6 or earlier, on Windows or macOS. An attacker needs the user to open a malicious file, and code then runs with that user's privileges. Studios and freelancers who open project or media files from outside sources should update first; machines without After Effects can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:01:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2904},"products":{"at":"2026-11-10T22:01:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2904},"who_affected":{"at":"2026-11-10T22:01:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2904}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativeworkstations","high","macos","package","windows"],"campaign_type":null,"search_a":"'-113516':17A,20A '-2026':16A,19A 'adob':1A 'after':21A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A","search_b":"'adob':24B,33B 'adobe-after-effect':23B 'attack':55B 'bound':41B 'code':57B 'craft':51B 'creativ':28B 'creative-workst':27B 'current':63B 'effect':26B,35B 'file':52B 'flaw':43B 'maco':30B 'open':49B 'out-of-bound':38B 'packag':31B 'privileg':60B 'run':56B 'success':54B 'trigger':47B 'user':64B 'window':32B 'workstat':29B 'write':42B","search_c":"'affect':68C 'arbitrari':81C 'bound':74C 'code':82C 'context':86C 'could':78C 'current':89C 'effect':66C 'execut':83C 'exploit':91C 'file':106C 'interact':97C 'issu':94C 'malici':105C 'must':102C 'open':103C 'out-of-bound':71C 'requir':95C 'result':79C 'user':90C,96C 'victim':101C 'vulner':76C 'write':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113516","severity":null,"published_at":"2026-11-10T21:18:43+00:00","modified_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","fetched_at":"2026-11-10T21:46:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113516:2904","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:01:18+00:00","modified_at":"2026-11-10T22:01:18+00:00","first_seen_at":"2026-11-10T22:01:18+00:00","fetched_at":"2026-11-10T22:01:18+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 / 26.5.3; no known exploitation. No other sources needed.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}