{"id":"CVE-2026-113530","kind":"vulnerability","aliases":["CVE-2026-113530"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","after-effects","creative-cloud","macos","package","user-interaction","windows"],"not_affected_if":["after-effects-26.5.3-or-later","after-effects-27.0-or-later","unknown"],"how_to_check":"Open After Effects > Help > About After Effects (macOS: After Effects menu > About). Exposed if version is 26.5 or earlier, including 25.6.6 and earlier; fixed in 26.5.3 and 27.0.","fix":"Update After Effects to 26.5.3 (26.x line) or 27.0 via Creative Cloud desktop app / Download Center. The 25.6.x line is listed as affected (25.6.6 and earlier) but the bulletin lists no fixed 25.x version; move to 26.5.3 or 27.0.","status":"open","published_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:10+00:00","updated_at":"2026-11-10T21:59:10+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:48:10Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","audience":"everyone","category":"package","nicknames":[],"who_cares":["after-effects","adobe","creative-cloud"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a malicious file","analyst_note":"Find the affected and fixed versions in Adobe's security bulletin for this CVE; the NVD entry gives none.","how_to_check":"- Open After Effects and check its version under Help > About After Effects, then compare against the fixed version in the sources (unknown)","plain_action":"Update Adobe After Effects to the fixed version from Adobe, and do not open project files from untrusted sources until you have.","product_name":"Adobe After Effects","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Anyone running an affected version of Adobe After Effects who opens project or media files from outside sources. The sources do not list affected version ranges, so unknown whether a given install is vulnerable. Teams that only use current, patched releases can skip it.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4521,"output_tokens":523,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed versions in Adobe's security bulletin for this CVE; the NVD entry gives none.","search":"'-113530':17A,20A '-2026':16A,19A 'adob':1A,23B,36B 'affect':72C 'after':21A 'after-effect':24B 'arbitrari':60B,85C 'attack':58B 'bound':7A,44B,78C 'cloud':29B 'code':14A,61B,86C 'context':90C 'could':82C 'craft':54B 'creativ':28B 'creative-cloud':27B 'current':67B,93C 'cve':15A,18A 'effect':3A,26B,38B,70C 'effects':22A 'execut':87C 'exploit':95C 'file':12A,55B,110C 'flaw':46B 'interact':34B,101C 'issu':98C 'let':9A 'maco':30B 'malici':11A,109C 'must':106C 'open':52B,107C 'out-of-bound':4A,41B,75C 'packag':31B 'privileg':64B 'requir':99C 'result':83C 'run':13A,59B 'success':57B 'trigger':50B 'user':33B,68B,94C,100C 'user-interact':32B 'victim':105C 'vulner':80C 'window':35B 'write':8A,45B,79C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects on Windows or macOS at 26.5 or earlier (including 25.6.6 and earlier). The flaw is triggered when a user opens a crafted file, and code runs with that user's privileges. Studios and freelancers who open files from outside sources should update first; machines without After Effects can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:59:10Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2898},"products":{"at":"2026-11-10T21:59:10Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2898},"how_to_check":{"at":"2026-11-10T21:59:10Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2898},"who_affected":{"at":"2026-11-10T21:59:10Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2898}},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":"Update Adobe After Effects to the fixed version from Adobe, and do not open project files from untrusted sources until you have.","pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobe","aftereffects","creativecloud","high","macos","package","userinteraction","windows"],"campaign_type":null,"search_a":"'-113530':17A,20A '-2026':16A,19A 'adob':1A 'after':21A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A","search_b":"'adob':23B,36B 'after-effect':24B 'arbitrari':60B 'attack':58B 'bound':44B 'cloud':29B 'code':61B 'craft':54B 'creativ':28B 'creative-cloud':27B 'current':67B 'effect':26B,38B 'file':55B 'flaw':46B 'interact':34B 'maco':30B 'open':52B 'out-of-bound':41B 'packag':31B 'privileg':64B 'run':59B 'success':57B 'trigger':50B 'user':33B,68B 'user-interact':32B 'window':35B 'write':45B","search_c":"'affect':72C 'arbitrari':85C 'bound':78C 'code':86C 'context':90C 'could':82C 'current':93C 'effect':70C 'execut':87C 'exploit':95C 'file':110C 'interact':101C 'issu':98C 'malici':109C 'must':106C 'open':107C 'out-of-bound':75C 'requir':99C 'result':83C 'user':94C,100C 'victim':105C 'vulner':80C 'write':79C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113530","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113530","severity":null,"published_at":"2026-11-10T21:18:44+00:00","modified_at":"2026-11-10T21:18:44+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113530:2898","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T21:59:10+00:00","modified_at":"2026-11-10T21:59:10+00:00","first_seen_at":"2026-11-10T21:59:10+00:00","fetched_at":"2026-11-10T21:59:10+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026): affected AE 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 and 26.5.3. Not exploited per Adobe; no PoC seen. Skipped social search (low conversation likelihood).","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}