CVE-2026-21322
Published: 10 February 2026
Summary
CVE-2026-21322 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 4.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2026-21322 by requiring timely identification, testing, and installation of patches for the out-of-bounds read vulnerability in After Effects as detailed in Adobe's APSB26-15 bulletin.
Addresses exploitation of the out-of-bounds read leading to code execution by enforcing runtime memory protections such as ASLR, DEP, and stack canaries.
Mitigates the vulnerability in parsing crafted files by requiring validation of file inputs to ensure consistency with expected formats before processing.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in file parser leads directly to arbitrary code execution upon opening a crafted malicious file (user interaction required).
NVD Description
After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute…
more
code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Deeper analysisAI
CVE-2026-21322 is an out-of-bounds read vulnerability (CWE-125) affecting Adobe After Effects versions 25.6 and earlier. The issue arises when parsing a crafted file, which could result in a read past the end of an allocated memory structure. Published on 2026-02-10, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rated as high severity.
Exploitation requires a victim to open a malicious file, enabling an attacker to leverage the vulnerability for arbitrary code execution in the context of the current user. The attack vector is local with low complexity and no privileges required, though user interaction is necessary.
Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, details the vulnerability and provides patches for mitigation.
Details
- CWE(s)