---
id: "CVE-2026-113526"
page: "https://infrastack.ai/live/CVE-2026-113526"
kind: "vulnerability"
aliases: ["CVE-2026-113526"]
title: "Adobe After Effects: malicious file lets attacker run code as user"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "After Effects", "fixed": ["27.0", "26.5.3"], "affected": "<= 26.5, <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe-after-effects", "creative-workstations", "macos", "other", "windows"]
not_affected_if: ["no-after-effects-installed"]
published_at: "2026-11-10T21:18:44+00:00"
first_seen_at: "2026-11-10T21:46:10+00:00"
updated_at: "2026-11-10T22:00:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113526", "first_seen_at": "2026-11-10T21:46:10+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html", "first_seen_at": "2026-11-10T22:00:23+00:00", "cites": ["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}]
exploit_sources: []
---

# Adobe After Effects: malicious file lets attacker run code as user

Link for people: https://infrastack.ai/live/CVE-2026-113526 (this .md is for agents)

Adobe After Effects has a design flaw that lets a malicious file run arbitrary code in the context of the current user. An attacker gets code execution on the victim's machine if the victim opens the crafted file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5, <= 25.6.6 fixed 27.0, 26.5.3

## How to check

In After Effects open About (Help > About After Effects on Windows, After Effects menu > About on macOS). Vulnerable: 26.5 and earlier, or 25.6.6 and earlier. Fixed: 27.0 or 26.5.3. For managed fleets, inventory installed After Effects versions.

## Fix

Update After Effects to 27.0 (or 26.5.3 on the 26.x line) via Creative Cloud / Download Center

## Timeline

- 2026-11-10T21:46:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113526
- 2026-11-10T22:00:23+00:00 analyst https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html — Adobe APSB26-100 (Nov 10 2026) read; affected/fixed versions confirmed, no exploitation known by Adobe.

## Documents

- [advisory] Adobe APSB26-100: Security update available for Adobe After Effects https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html

## From the sources

After Effects is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_