{"id":"CVE-2026-113523","kind":"vulnerability","aliases":["CVE-2026-113523"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation requires the victim to open a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5 and <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-after-effects","creative-cloud","macos","other","user-interaction","windows"],"not_affected_if":["not-installed"],"how_to_check":"In After Effects open About After Effects (Windows: Help > About After Effects; macOS: After Effects > About After Effects), or see the Creative Cloud desktop app. Affected: 26.5 and earlier, and 25.6.6 and earlier. Fixed: 26.5.3 and 27.0.","fix":"Update After Effects to 27.0, or to 26.5.3 if staying on the 26.x line (Creative Cloud desktop app or Download Center). Adobe lists no 25.x fixed build: 25.6.6 and earlier are affected, so move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:12+00:00","updated_at":"2026-11-10T22:00:12+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation requires the victim to open a malicious file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-after-effects","creative-cloud","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a file","analyst_note":"Find the affected and fixed After Effects versions and the Adobe bulletin for CVE-2026-113523 at the NVD link.","how_to_check":"- Check the installed After Effects version in the application's About screen or Creative Cloud app\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Teams that run Adobe After Effects on workstations and open project or media files from outside sources are exposed. Sources do not list affected version ranges, so unknown whether a specific build is affected. Teams that do not use After Effects can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":4521,"output_tokens":453,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed After Effects versions and the Adobe bulletin for CVE-2026-113523 at the NVD link.","search":"'-113523':17A,20A '-2026':16A,19A 'adob':1A,24B,36B 'adobe-after-effect':23B 'affect':69C 'after':21A 'arbitrari':82C 'attack':50B 'bound':7A,44B,75C 'cloud':29B 'code':14A,52B,83C 'context':87C 'could':79C 'creativ':28B 'creative-cloud':27B 'current':55B,90C 'cve':15A,18A 'effect':3A,26B,38B,67C 'effects':22A 'execut':84C 'exploit':57B,92C 'file':12A,65B,107C 'flaw':46B 'interact':34B,98C 'issu':95C 'let':9A,48B 'maco':30B 'malici':11A,64B,106C 'must':103C 'open':62B,104C 'out-of-bound':4A,41B,72C 'requir':58B,96C 'result':80C 'run':13A,51B 'user':33B,56B,91C,97C 'user-interact':32B 'victim':60B,102C 'vulner':77C 'window':35B 'write':8A,45B,76C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects on Windows or macOS at 26.5 or earlier (including 25.6.6 and earlier) is exposed. The flaw is triggered when the user opens a malicious project or media file, and code runs as that user. Teams without After Effects installed can skip it; Adobe says it is not aware of exploitation.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:00:12Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2902},"products":{"at":"2026-11-10T22:00:12Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2902},"how_to_check":{"at":"2026-11-10T22:00:12Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2902},"who_affected":{"at":"2026-11-10T22:00:12Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2902}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativecloud","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-113523':17A,20A '-2026':16A,19A 'adob':1A 'after':21A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A","search_b":"'adob':24B,36B 'adobe-after-effect':23B 'attack':50B 'bound':44B 'cloud':29B 'code':52B 'creativ':28B 'creative-cloud':27B 'current':55B 'effect':26B,38B 'exploit':57B 'file':65B 'flaw':46B 'interact':34B 'let':48B 'maco':30B 'malici':64B 'open':62B 'out-of-bound':41B 'requir':58B 'run':51B 'user':33B,56B 'user-interact':32B 'victim':60B 'window':35B 'write':45B","search_c":"'affect':69C 'arbitrari':82C 'bound':75C 'code':83C 'context':87C 'could':79C 'current':90C 'effect':67C 'execut':84C 'exploit':92C 'file':107C 'interact':98C 'issu':95C 'malici':106C 'must':103C 'open':104C 'out-of-bound':72C 'requir':96C 'result':80C 'user':91C,97C 'victim':102C 'vulner':77C 'write':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113523","severity":null,"published_at":"2026-11-10T21:18:43+00:00","modified_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113523:2902","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:00:12+00:00","modified_at":"2026-11-10T22:00:12+00:00","first_seen_at":"2026-11-10T22:00:12+00:00","fetched_at":"2026-11-10T22:00:12+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026, priority 3): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 and 26.5.3. Not exploited per Adobe. No public discussion searched; low-profile.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}