CVE-2026-21323
Published: 10 February 2026
Summary
CVE-2026-21323 is a high-severity Use After Free (CWE-416) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21323 is a Use After Free vulnerability (CWE-416) affecting Adobe After Effects versions 25.6 and earlier. The flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. Local attackers with no privileges (PR:N) can leverage low-complexity (AC:L) techniques to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 7.8.
Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, addresses this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6377
Vulnerability details
After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in client app enables arbitrary code execution via malicious file opened by victim (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely patching of After Effects per Adobe bulletin APSB26-15 directly remediates the Use After Free vulnerability preventing arbitrary code execution.
Memory protection safeguards such as ASLR and DEP directly prevent exploitation of the Use After Free vulnerability for code execution.
Malicious code protection scans and blocks malicious files before they can be opened in After Effects, mitigating exploitation requiring user interaction.