{"id":"CVE-2026-113536","kind":"vulnerability","aliases":["CVE-2026-113536"],"related":[],"title":"Adobe After Effects: opening a malicious file can run code (out-of-bounds write), fixed in 26.5.3 and 27.0","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"After Effects has an out-of-bounds write (CWE-787) that can run arbitrary code as the current user when someone opens a crafted file. Adobe fixed it in APSB26-100 and says it knows of no exploitation.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5 (26.x line); <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-after-effects","creative-workstations","macos","other","user-interaction","windows"],"not_affected_if":["not-installed","version-26.5.3-or-later","version-27.0-or-later"],"how_to_check":"In After Effects open Help > About After Effects (macOS: After Effects > About After Effects), or see the Creative Cloud desktop app. Exposed if version is 26.5 or earlier on the 26.x line (fixed in 26.5.3), or 25.6.6 or earlier on the 25.x line (Adobe's fix is 27.0).","fix":"Update Adobe After Effects to 27.0, or to 26.5.3 if staying on the 26.x line, via Creative Cloud desktop app or Download Center. Adobe lists no workaround.","status":"open","published_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:09+00:00","updated_at":"2026-11-10T21:59:02+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:48:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"After Effects has an out-of-bounds write flaw that can run arbitrary code in the context of the current user. An attacker gets code execution on the machine of a person who opens a crafted file.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-after-effects","creative-workstations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code as the logged-in user","analyst_note":"Find affected and fixed After Effects versions and the Adobe security bulletin for this CVE; the NVD entry alone names no ranges.","how_to_check":"- Open After Effects and check Help > About After Effects for the installed version\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-installed"],"who_is_affected":"Anyone running an affected version of Adobe After Effects on their workstation is exposed when they open a malicious file. The sources do not name the affected version ranges. Machines without After Effects installed are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000675,"input_tokens":4521,"output_tokens":445,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected and fixed After Effects versions and the Adobe security bulletin for this CVE; the NVD entry alone names no ranges.","search":"'-100':73B '-113536':23A,26A '-2026':22A,25A '-787':52B '26.5.3':18A '27.0':20A 'adob':1A,30B,68B 'adobe-after-effect':29B 'affect':84C 'after':27A 'apsb26':72B 'arbitrari':56B,97C 'bound':14A,49B,90C 'code':10A,57B,98C 'context':102C 'could':94C 'craft':66B 'creativ':34B 'creative-workst':33B 'current':60B,105C 'cve':21A,24A 'cwe':51B 'effect':3A,32B,43B,82C 'effects':28A 'execut':99C 'exploit':80B,107C 'file':7A,67B,122C 'fix':16A,69B 'interact':40B,113C 'issu':110C 'know':77B 'maco':36B 'malici':6A,121C 'must':118C 'open':4A,64B,119C 'out-of-bound':11A,46B,87C 'requir':111C 'result':95C 'run':9A,55B 'say':75B 'someon':63B 'user':39B,61B,106C,112C 'user-interact':38B 'victim':117C 'vulner':92C 'window':41B 'workstat':35B 'write':15A,50B,91C","nicknames":[],"mitigations":[],"who_affected":"Anyone running an affected version of Adobe After Effects on their workstation is exposed when they open a malicious file. The sources do not name the affected version ranges. Machines without After Effects installed are not affected.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:59:02Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2895},"products":{"at":"2026-11-10T21:59:02Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2895},"how_to_check":{"at":"2026-11-10T21:59:02Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2895},"who_affected":{"at":"2026-11-10T21:59:02Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2895}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativeworkstations","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-113536':23A,26A '-2026':22A,25A '26.5.3':18A '27.0':20A 'adob':1A 'after':27A 'bound':14A 'code':10A 'cve':21A,24A 'effect':3A 'effects':28A 'file':7A 'fix':16A 'malici':6A 'open':4A 'out-of-bound':11A 'run':9A 'write':15A","search_b":"'-100':73B '-787':52B 'adob':30B,68B 'adobe-after-effect':29B 'apsb26':72B 'arbitrari':56B 'bound':49B 'code':57B 'craft':66B 'creativ':34B 'creative-workst':33B 'current':60B 'cwe':51B 'effect':32B,43B 'exploit':80B 'file':67B 'fix':69B 'interact':40B 'know':77B 'maco':36B 'open':64B 'out-of-bound':46B 'run':55B 'say':75B 'someon':63B 'user':39B,61B 'user-interact':38B 'window':41B 'workstat':35B 'write':50B","search_c":"'affect':84C 'arbitrari':97C 'bound':90C 'code':98C 'context':102C 'could':94C 'current':105C 'effect':82C 'execut':99C 'exploit':107C 'file':122C 'interact':113C 'issu':110C 'malici':121C 'must':118C 'open':119C 'out-of-bound':87C 'requir':111C 'result':95C 'user':106C,112C 'victim':117C 'vulner':92C 'write':91C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113536","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113536","severity":null,"published_at":"2026-11-10T21:18:46+00:00","modified_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113536:2895","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T21:59:02+00:00","modified_at":"2026-11-10T21:59:02+00:00","first_seen_at":"2026-11-10T21:59:02+00:00","fetched_at":"2026-11-10T21:59:02+00:00","note":"Adobe APSB26-100 (Nov 10 2026, priority 3) read directly: affected 26.5 and earlier, 25.6.6 and earlier; fixed 26.5.3 / 27.0. No exploitation known per Adobe.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}