{"id":"CVE-2026-113517","kind":"vulnerability","aliases":["CVE-2026-113517"],"related":[],"title":"Adobe After Effects: out-of-bounds write when opening a malicious file allows code execution (fixed in 26.5.3 and 27.0)","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw. A victim who opens a malicious file can have arbitrary code run in the context of their current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","after-effects","creative-software","desktop","macos","other","windows"],"not_affected_if":["after-effects-26.5.3-or-later","after-effects-27.0-or-later","no-untrusted-files-opened"],"how_to_check":"Open After Effects, Help > About After Effects (macOS: After Effects > About). Exposed if the version is 26.5 or earlier (26.x) or 25.6.6 or earlier. Fixed at 26.5.3 or 27.0. Also check the Creative Cloud desktop app for installed versions.","fix":"Update After Effects to 26.5.3 (26.x line) or 27.0 via Creative Cloud desktop app; no fix is listed for 25.x in the bulletin beyond moving to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","triaged_at":"2026-11-10T21:48:13+00:00","updated_at":"2026-11-10T22:01:26+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw. A victim who opens a malicious file can have arbitrary code run in the context of their current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["after-effects","adobe","creative-software"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user after opening a file","analyst_note":"Find the vendor advisory (Adobe security bulletin) for affected and fixed versions and whether a patch exists.","how_to_check":"- Open After Effects and check the installed version under Help > About After Effects (version string not given in the sources)\n- unknown","plain_action":"","product_name":"Adobe After Effects","needs_analyst":true,"not_affected_if":["no-untrusted-files-opened"],"who_is_affected":"unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4521,"output_tokens":408,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the vendor advisory (Adobe security bulletin) for affected and fixed versions and whether a patch exists.","search":"'-113517':24A,27A '-2026':23A,26A '26.5.3':19A '27.0':21A 'adob':1A,30B,41B 'affect':74C 'after':28A 'after-effect':31B 'allow':14A 'arbitrari':61B,87C 'bound':7A,49B,80C 'code':15A,62B,88C 'context':66B,92C 'could':84C 'creativ':35B 'creative-softwar':34B 'current':69B,95C 'cve':22A,25A 'desktop':37B 'effect':3A,33B,43B,72C 'effects':29A 'execut':16A,89C 'exploit':97C 'file':13A,58B,112C 'fix':17A 'flaw':51B 'interact':103C 'issu':100C 'maco':38B 'malici':12A,57B,111C 'must':108C 'open':10A,55B,109C 'out-of-bound':4A,46B,77C 'requir':101C 'result':85C 'run':63B 'softwar':36B 'user':70B,96C,102C 'victim':53B,107C 'vulner':82C 'window':40B 'write':8A,50B,81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects on Windows or macOS at 26.5 or earlier, or 25.6.6 or earlier. The bug is triggered when a user opens a malicious project or media file, and code runs as that user (local attack, user interaction required). Teams that never open files from outside sources are at lower risk; the fix should still be applied.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:01:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2903},"products":{"at":"2026-11-10T22:01:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2903},"how_to_check":{"at":"2026-11-10T22:01:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2903},"who_affected":{"at":"2026-11-10T22:01:26Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2903}},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobe","aftereffects","creativesoftware","desktop","high","macos","other","windows"],"campaign_type":null,"search_a":"'-113517':24A,27A '-2026':23A,26A '26.5.3':19A '27.0':21A 'adob':1A 'after':28A 'allow':14A 'bound':7A 'code':15A 'cve':22A,25A 'effect':3A 'effects':29A 'execut':16A 'file':13A 'fix':17A 'malici':12A 'open':10A 'out-of-bound':4A 'write':8A","search_b":"'adob':30B,41B 'after-effect':31B 'arbitrari':61B 'bound':49B 'code':62B 'context':66B 'creativ':35B 'creative-softwar':34B 'current':69B 'desktop':37B 'effect':33B,43B 'file':58B 'flaw':51B 'maco':38B 'malici':57B 'open':55B 'out-of-bound':46B 'run':63B 'softwar':36B 'user':70B 'victim':53B 'window':40B 'write':50B","search_c":"'affect':74C 'arbitrari':87C 'bound':80C 'code':88C 'context':92C 'could':84C 'current':95C 'effect':72C 'execut':89C 'exploit':97C 'file':112C 'interact':103C 'issu':100C 'malici':111C 'must':108C 'open':109C 'out-of-bound':77C 'requir':101C 'result':85C 'user':96C,102C 'victim':107C 'vulner':82C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113517","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113517","severity":null,"published_at":"2026-11-10T21:18:43+00:00","modified_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:09+00:00","fetched_at":"2026-11-10T21:46:09+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113517:2903","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:01:26+00:00","modified_at":"2026-11-10T22:01:26+00:00","first_seen_at":"2026-11-10T22:01:26+00:00","fetched_at":"2026-11-10T22:01:26+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026): affected <=26.5 and <=25.6.6, fixed 26.5.3 / 27.0; no known exploitation per Adobe. No PoC/discussion sought (B tier, routine).","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}