{"id":"CVE-2026-113538","kind":"vulnerability","aliases":["CVE-2026-113538"],"related":[],"title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","description":"After Effects is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation requires the victim to open a malicious file.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5; <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","after-effects","creative-software","macos","package","user-interaction","windows"],"not_affected_if":["no-after-effects-installed","updated-to-26.5.3-or-27.0"],"how_to_check":"In After Effects open Help > About After Effects (Windows/macOS). Exposed if version is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier on the 25.x line; fixed in 26.5.3 and 27.0.","fix":"Update After Effects to 26.5.3 (26.x line) or 27.0 via Creative Cloud desktop app (Adobe APSB26-100).","status":"open","published_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","triaged_at":"2026-11-10T21:48:08+00:00","updated_at":"2026-11-10T22:41:03+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:48:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe After Effects has an out-of-bounds write flaw that lets an attacker run code as the current user. Exploitation requires the victim to open a malicious file.","audience":"businesses","category":"package","nicknames":[],"who_cares":["after-effects","adobe","creative-software"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after a malicious file is opened","analyst_note":"Find the Adobe security bulletin for this CVE to confirm affected and fixed versions.","how_to_check":"- Open After Effects and check the version under Help > About After Effects, then compare it with the fixed versions listed by Adobe.\n- unknown for any other check, the sources do not say.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-after-effects-installed"],"who_is_affected":"Teams that run Adobe After Effects on workstations, and anyone who opens project or media files from outside sources in it. The sources do not list affected versions. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000674,"input_tokens":4521,"output_tokens":443,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for this CVE to confirm affected and fixed versions.","search":"'-113538':17A,20A '-2026':16A,19A 'adob':1A,23B,36B 'affect':69C 'after':21A 'after-effect':24B 'arbitrari':82C 'attack':50B 'bound':7A,44B,75C 'code':14A,52B,83C 'context':87C 'could':79C 'creativ':28B 'creative-softwar':27B 'current':55B,90C 'cve':15A,18A 'effect':3A,26B,38B,67C 'effects':22A 'execut':84C 'exploit':57B,92C 'file':12A,65B,107C 'flaw':46B 'interact':34B,98C 'issu':95C 'let':9A,48B 'maco':30B 'malici':11A,64B,106C 'must':103C 'open':62B,104C 'out-of-bound':4A,41B,72C 'packag':31B 'requir':58B,96C 'result':80C 'run':13A,51B 'softwar':29B 'user':33B,56B,91C,97C 'user-interact':32B 'victim':60B,102C 'vulner':77C 'window':35B 'write':8A,45B,76C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects on Windows or macOS at 26.5 or earlier, or 25.6.6 or earlier. Exploitation needs the user to open a malicious file, so teams that open project or media files from outside sources are most exposed. Adobe says it is not aware of exploitation in the wild.","tier":"B","verified":{"fix":{"at":"2026-11-10T22:41:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":3026},"products":{"at":"2026-11-10T22:41:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":3026},"how_to_check":{"at":"2026-11-10T22:41:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":3026},"who_affected":{"at":"2026-11-10T22:41:03Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":3026}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobe","aftereffects","creativesoftware","high","macos","package","userinteraction","windows"],"campaign_type":null,"search_a":"'-113538':17A,20A '-2026':16A,19A 'adob':1A 'after':21A 'bound':7A 'code':14A 'cve':15A,18A 'effect':3A 'effects':22A 'file':12A 'let':9A 'malici':11A 'out-of-bound':4A 'run':13A 'write':8A","search_b":"'adob':23B,36B 'after-effect':24B 'attack':50B 'bound':44B 'code':52B 'creativ':28B 'creative-softwar':27B 'current':55B 'effect':26B,38B 'exploit':57B 'file':65B 'flaw':46B 'interact':34B 'let':48B 'maco':30B 'malici':64B 'open':62B 'out-of-bound':41B 'packag':31B 'requir':58B 'run':51B 'softwar':29B 'user':33B,56B 'user-interact':32B 'victim':60B 'window':35B 'write':45B","search_c":"'affect':69C 'arbitrari':82C 'bound':75C 'code':83C 'context':87C 'could':79C 'current':90C 'effect':67C 'execut':84C 'exploit':92C 'file':107C 'interact':98C 'issu':95C 'malici':106C 'must':103C 'open':104C 'out-of-bound':72C 'requir':96C 'result':80C 'user':91C,97C 'victim':102C 'vulner':77C 'write':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113538","severity":null,"published_at":"2026-11-10T21:18:46+00:00","modified_at":"2026-11-10T21:18:46+00:00","first_seen_at":"2026-11-10T21:46:10+00:00","fetched_at":"2026-11-10T21:46:10+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113538:3026","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T22:41:03+00:00","modified_at":"2026-11-10T22:41:03+00:00","first_seen_at":"2026-11-10T22:41:03+00:00","fetched_at":"2026-11-10T22:41:03+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026, priority 3): affected 26.5 and earlier, 25.6.6 and earlier; fixed 27.0 and 26.5.3; no exploitation known to Adobe. Not exploited, no PoC checked.","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}