CVE-2026-21321
Published: 10 February 2026
Summary
CVE-2026-21321 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Timely flaw remediation through patching After Effects per Adobe bulletin APSB26-15 directly eliminates the integer overflow vulnerability leading to arbitrary code execution.
Memory protection safeguards like DEP and ASLR mitigate arbitrary code execution exploits stemming from the integer overflow upon opening malicious files.
Malicious code protection mechanisms scan and block malicious After Effects files before user interaction enables the integer overflow exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow enables arbitrary code execution via crafted file opened by user (T1204.002), directly mapping to client-side exploitation (T1203).
NVD Description
After Effects versions 25.6 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2026-21321 is an Integer Overflow or Wraparound vulnerability (CWE-190) affecting Adobe After Effects versions 25.6 and earlier. The flaw could result in arbitrary code execution in the context of the current user, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). It was published on 2026-02-10.
Exploitation requires user interaction, as a victim must open a malicious file provided by an attacker. Local attackers with no privileges (PR:N) can leverage low-complexity (AC:L) techniques to deliver the file, leading to high-impact arbitrary code execution upon file opening, compromising confidentiality, integrity, and availability in the user's context.
Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, provides details on patches and mitigation recommendations.
Details
- CWE(s)