AFTER EFFECTS · CVE-2026-113532 · Other
FIX → 27.0 · 26.5.3 ✓ verified
Adobe bulletin APSB26-100 (Nov 10, 2026) lists CVE-2026-113532, a path traversal (CWE-22) in After Effects rated High, CVSS 8.6. Adobe gives the impact as arbitrary code execution; the NVD-derived text about reading files is not Adobe's wording. The vector is local and needs the user to open a malicious file. Adobe is not aware of exploits in the wild.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Adobe After Effects 26.5 or earlier, or 25.6.6 or earlier, on Windows or macOS is affected. Exploitation needs the user to open a malicious file, so studios and freelancers who receive project files or assets from outside are the ones to prioritise. Machines without After Effects, or users who only open trusted files, can skip it.
Not affected if no-after-effects-install, no-untrusted-project-files
Who cares adobe, after-effects, creative-cloud, macos, user-interaction, windows
25.6.6 or earlier on the 25.x line (Windows and macOS)After Effects is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 27.0 · 26.5.3
26.5.3 via the Creative Cloud desktop app or the Download Center26.5.3 or later