{"id":"CVE-2026-123263","kind":"vulnerability","aliases":["CVE-2026-123263"],"related":[],"title":"Adobe After Effects: heap overflow lets a malicious file run code","description":"After Effects is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"After Effects has a heap-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"After Effects","fixed":["26.5.3","27.0"],"affected":"<= 26.5, <= 25.6.6","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe-after-effects","creative-workstations","macos","other","user-interaction","windows"],"not_affected_if":["app-not-installed"],"how_to_check":"Open After Effects > Help > About After Effects (macOS: After Effects menu > About) and read the version. Exposed if it is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier. Fixed builds are 26.5.3 and 27.0.","fix":"Update Adobe After Effects to 26.5.3 or 27.0 (Windows and macOS) via the Creative Cloud desktop app or Adobe Download Center. Adobe lists no fixed build for the 25.6.x line; 25.6.6 and earlier are affected.","status":"open","published_at":"2026-11-10T21:19:04+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","triaged_at":"2026-11-10T21:47:55+00:00","updated_at":"2026-11-10T21:50:27+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe After Effects: heap overflow lets a malicious file run code","impact":"high","summary":"After Effects has a heap-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["adobe-after-effects","creative-workstations"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"code runs as the logged-in user on the workstation","analyst_note":"Find the Adobe security bulletin for this CVE to confirm the fixed After Effects versions and the patch.","how_to_check":"- Check the installed After Effects version in the Adobe application's About screen or Help menu\n- Compare it against the fixed versions listed by Adobe's advisory (unknown in the sources given)","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["app-not-installed"],"who_is_affected":"Teams that run Adobe After Effects on workstations are exposed when a user opens a malicious project or file. Systems without After Effects installed are not affected. The sources do not list fixed versions.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000681,"input_tokens":4528,"output_tokens":456,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Adobe security bulletin for this CVE to confirm the fixed After Effects versions and the patch.","search":"'-123263':14A,17A '-2026':13A,16A 'adob':1A,21B 'adobe-after-effect':20B 'affect':67C 'after':18A 'arbitrari':55B,80C 'attack':53B 'base':39B,72C 'buffer':40B,73C 'code':11A,56B,81C 'context':85C 'could':77C 'craft':49B 'creativ':25B 'creative-workst':24B 'current':62B,88C 'cve':12A,15A 'effect':3A,23B,34B,65C 'effects':19A 'execut':82C 'exploit':90C 'file':9A,50B,105C 'heap':4A,38B,71C 'heap-bas':37B,70C 'interact':31B,96C 'issu':93C 'let':6A 'maco':27B 'malici':8A,104C 'must':101C 'open':47B,102C 'overflow':5A,41B,74C 'privileg':59B 'requir':94C 'result':78C 'run':10A,54B 'success':52B 'trigger':45B 'user':30B,63B,89C,95C 'user-interact':29B 'victim':100C 'vulner':75C 'window':32B 'workstat':26B","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe After Effects 26.5 or earlier, or 25.6.6 or earlier, on Windows or macOS is exposed when a user opens a crafted project or file; the code runs with that user's privileges. Look at creative workstations and shared render or editing machines. Systems without After Effects installed can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:50:27Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2864},"products":{"at":"2026-11-10T21:50:27Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2864},"how_to_check":{"at":"2026-11-10T21:50:27Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2864},"who_affected":{"at":"2026-11-10T21:50:27Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","run_id":2864}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["aftereffects","effects"],"ptokens":["after","effects"],"labels":["adobeaftereffects","creativeworkstations","high","macos","other","userinteraction","windows"],"campaign_type":null,"search_a":"'-123263':14A,17A '-2026':13A,16A 'adob':1A 'after':18A 'code':11A 'cve':12A,15A 'effect':3A 'effects':19A 'file':9A 'heap':4A 'let':6A 'malici':8A 'overflow':5A 'run':10A","search_b":"'adob':21B 'adobe-after-effect':20B 'arbitrari':55B 'attack':53B 'base':39B 'buffer':40B 'code':56B 'craft':49B 'creativ':25B 'creative-workst':24B 'current':62B 'effect':23B,34B 'file':50B 'heap':38B 'heap-bas':37B 'interact':31B 'maco':27B 'open':47B 'overflow':41B 'privileg':59B 'run':54B 'success':52B 'trigger':45B 'user':30B,63B 'user-interact':29B 'window':32B 'workstat':26B","search_c":"'affect':67C 'arbitrari':80C 'base':72C 'buffer':73C 'code':81C 'context':85C 'could':77C 'current':88C 'effect':65C 'execut':82C 'exploit':90C 'file':105C 'heap':71C 'heap-bas':70C 'interact':96C 'issu':93C 'malici':104C 'must':101C 'open':102C 'overflow':74C 'requir':94C 'result':78C 'user':89C,95C 'victim':100C 'vulner':75C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:19:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123263","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123263","severity":null,"published_at":"2026-11-10T21:19:04+00:00","modified_at":"2026-11-10T21:19:04+00:00","first_seen_at":"2026-11-10T21:46:15+00:00","fetched_at":"2026-11-10T21:46:15+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123263:2864","url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","severity":null,"published_at":"2026-11-10T21:50:27+00:00","modified_at":"2026-11-10T21:50:27+00:00","first_seen_at":"2026-11-10T21:50:27+00:00","fetched_at":"2026-11-10T21:50:27+00:00","note":"Read Adobe APSB26-100 (Nov 10 2026): CVE listed, fixed in 27.0 and 26.5.3; not exploited per Adobe. No PoC/social checked (same-day disclosure).","cites":["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}],"documents":[{"id":119294,"url":"https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html","title":"Adobe APSB26-100: Security update available for Adobe After Effects","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}