---
id: "CVE-2026-123263"
page: "https://infrastack.ai/live/CVE-2026-123263"
kind: "vulnerability"
aliases: ["CVE-2026-123263"]
title: "Adobe After Effects: heap overflow lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "After Effects", "fixed": ["26.5.3", "27.0"], "affected": "<= 26.5, <= 25.6.6", "ecosystem": "vendor"}]
ecosystems: []
tags: ["adobe-after-effects", "creative-workstations", "macos", "other", "user-interaction", "windows"]
not_affected_if: ["app-not-installed"]
published_at: "2026-11-10T21:19:04+00:00"
first_seen_at: "2026-11-10T21:46:15+00:00"
updated_at: "2026-11-10T21:50:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123263", "first_seen_at": "2026-11-10T21:46:15+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html", "first_seen_at": "2026-11-10T21:50:27+00:00", "cites": ["https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html"]}]
exploit_sources: []
---

# Adobe After Effects: heap overflow lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-123263 (this .md is for agents)

After Effects has a heap-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:After Effects affected <= 26.5, <= 25.6.6 fixed 26.5.3, 27.0

## How to check

Open After Effects > Help > About After Effects (macOS: After Effects menu > About) and read the version. Exposed if it is 26.5 or earlier on the 26.x line, or 25.6.6 or earlier. Fixed builds are 26.5.3 and 27.0.

## Fix

Update Adobe After Effects to 26.5.3 or 27.0 (Windows and macOS) via the Creative Cloud desktop app or Adobe Download Center. Adobe lists no fixed build for the 25.6.x line; 25.6.6 and earlier are affected.

## Timeline

- 2026-11-10T21:46:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123263
- 2026-11-10T21:50:27+00:00 analyst https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html — Read Adobe APSB26-100 (Nov 10 2026): CVE listed, fixed in 27.0 and 26.5.3; not exploited per Adobe. No PoC/social checked (same-day disclosure).

## Documents

- [advisory] Adobe APSB26-100: Security update available for Adobe After Effects https://www.adobe.com/trust/security/products/after-effects/apsb26-100.html

## From the sources

After Effects is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_