{"id":"CVE-2026-113528","kind":"vulnerability","aliases":["CVE-2026-113528"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation needs the victim to open a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3"],"affected":"<= 26.5","ecosystem":"vendor"},{"name":"After Effects 25.x","fixed":["27.0"],"affected":"<= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","after-effects","creative-software","macos","package","user-interaction","windows"],"not_affected_if":["no-after-effects-install"],"how_to_check":"Help > About After Effects (Windows) or After Effects > About After Effects (macOS). Exposed if the version is 26.5 or earlier on the 26.x line (fixed in 26.5.3), or 25.6.6 or earlier on the 25.x line (fixed in 27.0).","fix":"Update After Effects to 26.5.3 or later (26.x line) or to 27.0 (25.6.x line, per the CVE record). Via Creative Cloud desktop app.","status":"open","published_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:11+00:00","updated_at":"2026-11-10T22:00:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-10T21:48:11Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation needs the victim to open a malicious file.","audience":"businesses","category":"package","nicknames":[],"who_cares":["after-effects","adobe","creative-software"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs code as the logged-in user after the victim opens a file.","analyst_note":"Find the Adobe security bulletin for this CVE to confirm affected versions and the fixed build.","how_to_check":"- Open After Effects and check the version under Help > About After Effects, then compare it with the fixed version in the Adobe advisory.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-after-effects-install"],"who_is_affected":"Teams that run Adobe After Effects on workstations opening project or media files from outside sources. The sources do not list affected version ranges. Systems where no one installs After Effects can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4521,"output_tokens":446,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for this CVE to confirm affected versions and the fixed build.","search":"'-113528':17A,20A '-2026':16A,19A '25':25A 'adob':1A,27B,40B 'affect':73C 'after':21A,23A 'after-effect':28B 'arbitrari':86C 'attack':54B 'bound':7A,48B,79C 'code':14A,56B,87C 'context':91C 'could':83C 'creativ':32B 'creative-softwar':31B 'current':59B,94C 'cve':15A,18A 'effect':3A,30B,42B,71C 'effects':22A,24A 'execut':88C 'exploit':61B,96C 'file':12A,69B,111C 'flaw':50B 'interact':38B,102C 'issu':99C 'let':9A,52B 'maco':34B 'malici':11A,68B,110C 'must':107C 'need':62B 'open':66B,108C 'out-of-bound':4A,45B,76C 'packag':35B 'requir':100C 'result':84C 'run':13A,55B 'softwar':33B 'user':37B,60B,95C,101C 'user-interact':36B 'victim':64B,106C 'vulner':81C 'window':39B 'write':8A,49B,80C 'x':26A","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects on Windows or macOS who opens project or media files from outside sources. Exploitation needs the user to open a malicious file, and code runs with that user's rights. Machines without After Effects can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","aftereffects25x","effects","effects25x"],"ptokens":["25","after","effects"],"labels":["adobe","aftereffects","creativesoftware","high","macos","package","userinteraction","windows"],"campaign_type":null,"search_a":"'-113528':17A,20A '-2026':16A,19A '25':25A 'adob':1A 'after':21A,23A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A,24A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A 'x':26A","search_b":"'adob':27B,40B 'after-effect':28B 'attack':54B 'bound':48B 'code':56B 'creativ':32B 'creative-softwar':31B 'current':59B 'effect':30B,42B 'exploit':61B 'file':69B 'flaw':50B 'interact':38B 'let':52B 'maco':34B 'malici':68B 'need':62B 'open':66B 'out-of-bound':45B 'packag':35B 'run':55B 'softwar':33B 'user':37B,60B 'user-interact':36B 'victim':64B 'window':39B 'write':49B","search_c":"'affect':73C 'arbitrari':86C 'bound':79C 'code':87C 'context':91C 'could':83C 'current':94C 'effect':71C 'execut':88C 'exploit':96C 'file':111C 'interact':102C 'issu':99C 'malici':110C 'must':107C 'open':108C 'out-of-bound':76C 'requir':100C 'result':84C 'user':95C,101C 'victim':106C 'vulner':81C 'write':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:02:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113528","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113528","severity":null,"published_at":"2026-11-10T21:18:44+00:00","modified_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113528:2899","url":"https://notcve.org/advisory/APSB26-100/","severity":null,"published_at":"2026-11-10T22:00:38+00:00","modified_at":"2026-11-10T22:00:38+00:00","first_seen_at":"2026-11-10T22:00:38+00:00","fetched_at":"2026-11-10T22:00:38+00:00","note":"Part of Adobe APSB26-100 (17 CVEs, priority 3, no known exploitation per ZDI). Adobe's own bulletin page was not retrievable (404/empty), so versions come from the CVE record via OpenCVE and nothing is marked verified. Web search worked; X not checked.","cites":["https://notcve.org/advisory/APSB26-100/","https://app.opencve.io/cve/CVE-2026-113528"]}],"documents":[{"id":119349,"url":"https://notcve.org/advisory/APSB26-100/","title":"APSB26-100 Adobe After Effects (NotCVE index of Adobe bulletin)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":119350,"url":"https://app.opencve.io/cve/CVE-2026-113528","title":"CVE-2026-113528 OpenCVE (CVE record version data)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":117344,"url":"https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review","title":"ZDI: November 2026 Security Update Review","kind":"blog","source":"blog","publisher":null,"text":"The November 2026 Security Update Review\n\nThe penultimate month of 2026 bring with it the usual storm of patches from Microsoft and Adobe. I’ve been prototyping some new ways to display this data, but as always, I’m open to suggestions. Seriously – hit me up on Bluesky if you have any ideas. If you’d rather watch the full video recap covering the entire release, you can check out the Patch Report webcast on our YouTube channel. It should be posted within a couple of hours after the release. Adobe Patches for November 2026 For the first part of the November release, Adobe released nine bulletins addressing 110 unique CVEs in Adobe Connect, Experience Manager, After Effects, Audition, Dimension, Photoshop, Media Encoder, Premiere, and Content Credentials SDK. Here’s this month’s overview table: Adobe Patches for November 2026 Bulletin ID Product CVE Count Highest Severity Highest CVSS Exploited Deployment Priority APSB26-191 Adobe Connect 24 Critical 10.0 No 2 APSB26-189 Adobe Experience Manager 14 Critical 9.9 No 2 APSB26-102 Adobe Audition 11 High 8.7 No 3 APSB26-100 Adobe After Effects 17 High 8.6 No 3 APSB26-190 Adobe Dimension 1 High 8.2 No 3 APSB26-181 Adobe Photoshop 13 High 7.8 No 3 APSB26-101 Adobe Premiere 11 High 7.8 No 3 APSB26-103 Adobe Media Encoder 6 High 7.8 No 3 APSB26-184 Content Credentials SDK 13 Medium 6.5 No 3 TOTAL 9 bulletins 110 Obviously, if you need to prioritize, the Connect patch is the biggest and most severe bulletin this month: 24 CVEs, 18 of them Critical, with a top CVSS of 10.0. It’s Priority 2, and Adobe is not aware of any exploits in the wild. Each of the CVSS10 bugs are reachable over the network with no authentication or user interaction, and each changes scope. The other Critical-rated update for this month is in Experience Manager . It addresses 14 CVEs, which includes four Critical bugs with a CVSS 9.9 rating. Two are incorrect-authorization bugs and two are code injections. All give arbitrary code execution over the network. Each needs a low-privileged account but no user interaction, and each changes scope. Besides the bugs already mentioned, all other patched from Adobe are a Deployment Priority 3. None of the other Adobe bugs receiving patches this month are listed as publicly known or under active attack at the time of release. Microsoft Patches for November 2026 Well, at least it’s not a new record for Microsoft. As always, the overall count is a bit confusing, but I see about 1,090 new CVEs released today. At this point, does the exact number actually matter? Regardless of the actual count, it’s huge but less than the 1,400 or so released last month. That’s two months in a row that have exceeded all previous years from Microsoft. As for the products affected by this release, we have Windows and Windows components; Office and Office Components; Windows networking and remote access; Windows graphics, media and printing; Windows storage file systems and drivers; .NET and Visual Studio; Windows Security and identity; Azure, cloud and identity; Exchange Server; Microsoft Dynamics; and Xbox. We’ll see how close I came to matching Microsoft’s “ Cohorts ” list. Interestingly, there is only one bug under active attack, and none are publicly known this month. While this is encouraging, it does not mean we’re seeing less exploitation in the wild. It does mean we are seeing fewer 0-days exploited in the wild. This makes sense, as AI is better at reversing patches than it is at finding and exploiting bugs in closed-source software. Let’s begin by covering some of the more severe and interesting patches released this month. - CVE-2026-124194 - Microsoft Outlook Spoofing Vulnerability This is the one bug under active attack this month. It’s labeled spoofing, but the impact is bigger than the name suggests. An attacker sends a specially crafted message file and convinces a user to open it. Outlook then connects to an attacker-controlled network location without showing the usual external-content warning, which discloses the user’s NTLMv","published_at":"2026-11-10T19:02:41+00:00","relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}