CVE-2026-21320
Published: 10 February 2026
Summary
CVE-2026-21320 is a high-severity Use After Free (CWE-416) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly mitigating this Use After Free vulnerability by applying Adobe patches for After Effects.
SI-3 deploys malicious code protection mechanisms that scan and block malicious files exploiting the UAF vulnerability before they are opened.
SI-16 implements memory protections like ASLR and DEP that hinder arbitrary code execution from Use After Free exploits in After Effects.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in client app (After Effects) directly enables code exec via malicious file open (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
NVD Description
After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2026-21320 is a Use After Free vulnerability (CWE-416) affecting Adobe After Effects versions 25.6 and earlier. Published on 2026-02-10, it enables arbitrary code execution in the context of the current user when exploited.
The attack requires local access (AV:L) with low complexity (AC:L) and no privileges (PR:N), but necessitates user interaction (UI:R) via opening a malicious file. Successful exploitation allows an attacker to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an overall CVSS v3.1 score of 7.8 and no change in scope (S:U).
Adobe's security bulletin (APSB26-15) at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html provides further details on mitigation and patches.
Details
- CWE(s)