---
id: "CVE-2026-113536"
page: "https://infrastack.ai/live/CVE-2026-113536"
kind: "vulnerability"
aliases: ["CVE-2026-113536"]
title: "Adobe After Effects: opening a malicious file can run code (out-of-bounds write), fixed in 26.5.3 and 27.0"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "After Effects", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5 (26.x line); <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-after-effects", "creative-workstations", "macos", "other", "user-interaction", "windows"]
not_affected_if: ["not-installed", "version-26.5.3-or-later", "version-27.0-or-later"]
published_at: "2026-11-10T21:18:46+00:00"
first_seen_at: "2026-11-10T21:46:10+00:00"
updated_at: "2026-11-10T21:59:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-113536", "first_seen_at": "2026-11-10T21:46:10+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html", "first_seen_at": "2026-11-10T21:59:02+00:00", "cites": ["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}]
exploit_sources: []
---

# Adobe After Effects: opening a malicious file can run code (out-of-bounds write), fixed in 26.5.3 and 27.0

Link for people: https://infrastack.ai/live/CVE-2026-113536 (this .md is for agents)

After Effects has an out-of-bounds write (CWE-787) that can run arbitrary code as the current user when someone opens a crafted file. Adobe fixed it in APSB26-100 and says it knows of no exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5 (26.x line); <= 25.6.6 fixed 26.5.3, 27.0

## How to check

In After Effects open Help > About After Effects (macOS: After Effects > About After Effects), or see the Creative Cloud desktop app. Exposed if version is 26.5 or earlier on the 26.x line (fixed in 26.5.3), or 25.6.6 or earlier on the 25.x line (Adobe's fix is 27.0).

## Fix

Update Adobe After Effects to 27.0, or to 26.5.3 if staying on the 26.x line, via Creative Cloud desktop app or Download Center. Adobe lists no workaround.

## Timeline

- 2026-11-10T21:46:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-113536
- 2026-11-10T21:59:02+00:00 analyst https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html — Adobe APSB26-100 (Nov 10 2026, priority 3) read directly: affected 26.5 and earlier, 25.6.6 and earlier; fixed 26.5.3 / 27.0. No exploitation known per Adobe.

## Documents

- [advisory] Adobe APSB26-100: Security update available for Adobe After Effects https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html

## From the sources

After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_