---
id: "CVE-2026-113528"
page: "https://infrastack.ai/live/CVE-2026-113528"
kind: "vulnerability"
aliases: ["CVE-2026-113528"]
title: "Adobe After Effects: out-of-bounds write lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "After Effects", "fixed": ["26.5.3"], "affected": "<= 26.5", "ecosystem": "vendor"}, {"name": "After Effects 25.x", "fixed": ["27.0"], "affected": "<= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe", "after-effects", "creative-software", "macos", "package", "user-interaction", "windows"]
not_affected_if: ["no-after-effects-install"]
published_at: "2026-11-10T21:18:44+00:00"
first_seen_at: "2026-11-10T21:46:10+00:00"
updated_at: "2026-11-10T22:00:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113528", "first_seen_at": "2026-11-10T21:46:10+00:00"}, {"source": "analyst", "url": "https://notcve.org/advisory/APSB26-100/", "first_seen_at": "2026-11-10T22:00:38+00:00", "cites": ["https://notcve.org/advisory/APSB26-100/", "https://app.opencve.io/cve/CVE-2026-113528"]}]
exploit_sources: []
---

# Adobe After Effects: out-of-bounds write lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-113528 (this .md is for agents)

Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation needs the victim to open a malicious file.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5 fixed 26.5.3
- vendor:After Effects 25.x affected <= 25.6.6 fixed 27.0

## How to check

Help > About After Effects (Windows) or After Effects > About After Effects (macOS). Exposed if the version is 26.5 or earlier on the 26.x line (fixed in 26.5.3), or 25.6.6 or earlier on the 25.x line (fixed in 27.0).

## Fix

Update After Effects to 26.5.3 or later (26.x line) or to 27.0 (25.6.x line, per the CVE record). Via Creative Cloud desktop app.

## Timeline

- 2026-11-10T21:46:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113528
- 2026-11-10T22:00:38+00:00 analyst https://notcve.org/advisory/APSB26-100/ — Part of Adobe APSB26-100 (17 CVEs, priority 3, no known exploitation per ZDI). Adobe's own bulletin page was not retrievable (404/empty), so versions come from the CVE record via OpenCVE and nothing is marked verified. Web search worked; X not checked.

## Documents

- [describes] APSB26-100 Adobe After Effects (NotCVE index of Adobe bulletin) https://notcve.org/advisory/APSB26-100/
- [describes] CVE-2026-113528 OpenCVE (CVE record version data) https://app.opencve.io/cve/CVE-2026-113528
- [mentions] ZDI: November 2026 Security Update Review https://www.thezdi.com/blog/2026/11/10/the-november-2026-security-update-review

## From the sources

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_