Adobe After Effects Type Confusion Vulnerability Leading to Arbitrary Code Execution

Vulnerability

A type confusion vulnerability allowing arbitrary code execution has been identified in Adobe After Effects versions 25.6 and earlier. This vulnerability requires user interaction, as a victim must open a malicious file for exploitation to occur.

Impact

Exploitation of this vulnerability could result in arbitrary code execution in the context of the current user.

Remediation

Users are advised to update to Adobe After Effects versions 25.6.4 or 26.0, available through the Adobe Download Center. For managed environments, IT administrators can deploy these updates using the Admin Console.

Added: Feb 10, 2026, 6:43 PM
Updated: Feb 11, 2026, 1:58 AM

Vulnerability Rating

Custom Algorithm
spread
5.4
impact
2.5
exploitability
3.6
remediation
7.7
relevance
3.0
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.