CVE-2026-21326CWE-416

CVE-2026-21326

High · published February 10, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
16.3
In the wild
Unconfirmed
What it is

⚡ A crafty file could give an attacker the keys to your system. After Effects versions 25.6 and earlier have a sneaky Use After Free vulnerability that lets arbitrary code execution slip in, but it only starts with user interaction! 🎨 Think of it like a movie theater that accidentally reuses tickets for different films; once you walk in, you might find yourself in a completely different storyline. In this case, opening a malicious file in After Effects can lead to unexpected and dangerous outcomes for your system! If exploited, an attacker could execute arbitrary code within the context of the current user, effectively turning any unsuspecting artist into an unwitting accomplice. This means they could manipulate files, steal sensitive information, or even take control of the system without the user's knowledge!

Put simply

Think of it like a movie theater that accidentally reuses tickets for different films; once you walk in, you might find yourself in a completely different storyline. In this case, opening a malicious file in After Effects can lead to unexpected and dangerous outcomes for your system! This Use After Free vulnerability occurs when After Effects fails to properly handle certain memory allocations, allowing an attacker to execute arbitrary code by tricking the user into opening a specially crafted file.

What to do

If exploited, an attacker could execute arbitrary code within the context of the current user, effectively turning any unsuspecting artist into an unwitting accomplice. This means they could manipulate files, steal sensitive information, or even take control of the system without the user's knowledge! To protect yourself, update After Effects to version 25.6.1 or later immediately. Additionally, avoid opening files from untrusted sources to minimize the risk of exploitation. Keeping your software current is key! You've got this! By following these steps, you'll lock down your system tighter than a drum. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00256 · 16.3th percentile
Weakness
CWE-416 · Use After Free
Published
2026-02-10T23:16Z
Affected products (1)
ProductVersionsFixed in
adobe/after_effects< 25.6.425.6.4
References (1)
EPSS history
Timeline
  • 10 FEB 17:53Z
    After Effects | Use After Free (CWE-416)
    cvelistv5