{"id":"CVE-2026-113526","kind":"vulnerability","aliases":["CVE-2026-113526"],"related":[],"title":"Adobe After Effects: malicious file lets attacker run code as user","description":"After Effects is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.","summary":"Adobe After Effects has a design flaw that lets a malicious file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine if the victim opens the crafted file.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["27.0","26.5.3"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["adobe-after-effects","creative-workstations","macos","other","windows"],"not_affected_if":["no-after-effects-installed"],"how_to_check":"In After Effects open About (Help > About After Effects on Windows, After Effects menu > About on macOS). Vulnerable: 26.5 and earlier, or 25.6.6 and earlier. Fixed: 27.0 or 26.5.3. For managed fleets, inventory installed After Effects versions.","fix":"Update After Effects to 27.0 (or 26.5.3 on the 26.x line) via Creative Cloud / Download Center","status":"open","published_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:47:53+00:00","updated_at":"2026-11-10T22:00:23+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:53Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: malicious file lets attacker run code as user","impact":"high","summary":"Adobe After Effects has a design flaw that lets a malicious file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine if the victim opens the crafted file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-after-effects","creative-workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs as the logged-in user on the workstation","analyst_note":"Find Adobe's security bulletin for this CVE to confirm affected versions and the fixed build.","how_to_check":"- Check the installed After Effects version in the application's About screen or Help menu\n- unknown","plain_action":"","product_name":"After Effects","needs_analyst":true,"not_affected_if":["no-after-effects-installed"],"who_is_affected":"Teams that run Adobe After Effects on workstations are exposed when a user opens a file from an untrusted source. The sources do not name affected versions. Systems that do not have After Effects installed can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4556,"output_tokens":465,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for this CVE to confirm affected versions and the fixed build.","search":"'-113526':14A,17A '-2026':13A,16A 'adob':1A,21B,30B 'adobe-after-effect':20B 'affect':72C 'after':18A 'arbitrari':43B,85C,103C 'attack':7A,53B,96C 'chang':123C 'code':9A,44B,55B,86C,104C 'context':47B,90C 'could':82C,97C 'craft':67B 'creativ':25B 'creative-workst':24B 'current':50B,93C 'cve':12A,15A 'design':35B,78C 'effect':3A,23B,32B,70C 'effects':19A 'execut':56B,87C,102C 'exploit':98C,105C 'file':5A,41B,68B,120C 'flaw':36B 'get':54B 'interact':111C 'issu':108C 'let':6A,38B 'machin':61B 'maco':27B 'malici':4A,40B,119C 'must':116C 'open':65B,117C 'principl':79C 'requir':109C 'result':83C 'run':8A,42B 'scope':121C 'secur':77C 'user':11A,51B,94C,110C 'victim':59B,64B,115C 'violat':75C 'vulner':80C,100C 'window':29B 'workstat':26B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects 26.5 and earlier, or 25.6.6 and earlier, on Windows or macOS is affected. Exploitation needs the user to open a malicious file (local, user interaction, scope changed), so risk is highest for teams that open project files or assets from outside sources. Machines without After Effects can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:00:23Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2900},"products":{"at":"2026-11-10T22:00:23Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2900},"how_to_check":{"at":"2026-11-10T22:00:23Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2900},"who_affected":{"at":"2026-11-10T22:00:23Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2900}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativeworkstations","high","macos","other","vendor","windows"],"campaign_type":null,"search_a":"'-113526':14A,17A '-2026':13A,16A 'adob':1A 'after':18A 'attack':7A 'code':9A 'cve':12A,15A 'effect':3A 'effects':19A 'file':5A 'let':6A 'malici':4A 'run':8A 'user':11A","search_b":"'adob':21B,30B 'adobe-after-effect':20B 'arbitrari':43B 'attack':53B 'code':44B,55B 'context':47B 'craft':67B 'creativ':25B 'creative-workst':24B 'current':50B 'design':35B 'effect':23B,32B 'execut':56B 'file':41B,68B 'flaw':36B 'get':54B 'let':38B 'machin':61B 'maco':27B 'malici':40B 'open':65B 'run':42B 'user':51B 'victim':59B,64B 'window':29B 'workstat':26B","search_c":"'affect':72C 'arbitrari':85C,103C 'attack':96C 'chang':123C 'code':86C,104C 'context':90C 'could':82C,97C 'current':93C 'design':78C 'effect':70C 'execut':87C,102C 'exploit':98C,105C 'file':120C 'interact':111C 'issu':108C 'malici':119C 'must':116C 'open':117C 'principl':79C 'requir':109C 'result':83C 'scope':121C 'secur':77C 'user':94C,110C 'victim':115C 'violat':75C 'vulner':80C,100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113526","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113526","severity":null,"published_at":"2026-11-10T21:18:44+00:00","modified_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113526:2900","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:00:23+00:00","modified_at":"2026-11-10T22:00:23+00:00","first_seen_at":"2026-11-10T22:00:23+00:00","fetched_at":"2026-11-10T22:00:23+00:00","note":"Adobe APSB26-100 (Nov 10 2026) read; affected/fixed versions confirmed, no exploitation known by Adobe.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}