{"id":"CVE-2026-113525","kind":"vulnerability","aliases":["CVE-2026-113525"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. The victim must open a crafted file for the attack to work.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5 (also <= 25.6.6)","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-after-effects","creative-software","macos","package","user-interaction","windows"],"not_affected_if":["no-untrusted-files-opened","patched-26.5.3","patched-27.0"],"how_to_check":"In After Effects open About After Effects (Windows: Help > About After Effects; macOS: After Effects menu > About) and read the version. Affected: 26.5 and earlier, including 25.6.6 and earlier. Fixed: 26.5.3 or 27.0. Also check Creative Cloud desktop app > Apps for the installed version.","fix":"Update After Effects to 27.0, or 26.5.3 on the 26.x line, via Creative Cloud desktop app. Branch 25.x (25.6.6 and earlier) is listed as affected; the bulletin names no 25.x fix, so move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:12+00:00","updated_at":"2026-11-10T22:00:16+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:48:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. The victim must open a crafted file for the attack to work.","audience":"businesses","category":"package","nicknames":[],"who_cares":["adobe-after-effects","creative-software","windows","macos"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a malicious file","analyst_note":"Find the affected and fixed After Effects versions in Adobe's security bulletin; the sources give none.","how_to_check":"- Check the installed After Effects version in the application's About or version information\n- unknown","plain_action":"","product_name":"Adobe After Effects","needs_analyst":true,"not_affected_if":["no-untrusted-files-opened"],"who_is_affected":"Anyone running Adobe After Effects on a machine that opens files from untrusted sources. Exposure depends on the installed version, which the sources do not name. unknown","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4521,"output_tokens":445,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed After Effects versions in Adobe's security bulletin; the sources give none.","search":"'-113525':17A,20A '-2026':16A,19A 'adob':1A,24B,36B 'adobe-after-effect':23B 'affect':72C 'after':21A 'arbitrari':85C 'attack':50B,66B 'bound':7A,44B,78C 'code':14A,52B,86C 'context':90C 'could':82C 'craft':62B 'creativ':28B 'creative-softwar':27B 'current':55B,93C 'cve':15A,18A 'effect':3A,26B,38B,70C 'effects':22A 'execut':87C 'exploit':95C 'file':12A,63B,110C 'flaw':46B 'interact':34B,101C 'issu':98C 'let':9A,48B 'maco':30B 'malici':11A,109C 'must':59B,106C 'open':60B,107C 'out-of-bound':4A,41B,75C 'packag':31B 'requir':99C 'result':83C 'run':13A,51B 'softwar':29B 'user':33B,56B,94C,100C 'user-interact':32B 'victim':58B,105C 'vulner':80C 'window':35B 'work':68B 'write':8A,45B,79C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects 26.5 or earlier (including 25.6.6 and earlier) on Windows or macOS. Exploitation needs a user to open a malicious project or media file, so it matters most for editors and studios that receive files from clients, freelancers or downloads. Machines without After Effects, or users who open only trusted files and are updated, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:00:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2901},"products":{"at":"2026-11-10T22:00:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2901},"how_to_check":{"at":"2026-11-10T22:00:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2901},"who_affected":{"at":"2026-11-10T22:00:16Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2901}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativesoftware","high","macos","package","userinteraction","windows"],"campaign_type":null,"search_a":"'-113525':17A,20A '-2026':16A,19A 'adob':1A 'after':21A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A","search_b":"'adob':24B,36B 'adobe-after-effect':23B 'attack':50B,66B 'bound':44B 'code':52B 'craft':62B 'creativ':28B 'creative-softwar':27B 'current':55B 'effect':26B,38B 'file':63B 'flaw':46B 'interact':34B 'let':48B 'maco':30B 'must':59B 'open':60B 'out-of-bound':41B 'packag':31B 'run':51B 'softwar':29B 'user':33B,56B 'user-interact':32B 'victim':58B 'window':35B 'work':68B 'write':45B","search_c":"'affect':72C 'arbitrari':85C 'bound':78C 'code':86C 'context':90C 'could':82C 'current':93C 'effect':70C 'execut':87C 'exploit':95C 'file':110C 'interact':101C 'issu':98C 'malici':109C 'must':106C 'open':107C 'out-of-bound':75C 'requir':99C 'result':83C 'user':94C,100C 'victim':105C 'vulner':80C 'write':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113525","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113525","severity":null,"published_at":"2026-11-10T21:18:43+00:00","modified_at":"2026-11-10T21:18:43+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113525:2901","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:00:16+00:00","modified_at":"2026-11-10T22:00:16+00:00","first_seen_at":"2026-11-10T22:00:16+00:00","fetched_at":"2026-11-10T22:00:16+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026): CVE listed, affected <=26.5 and <=25.6.6, fixed 26.5.3 / 27.0; no exploitation known.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}