Cyber Posture

CVE-2026-21323

High

Published: 10 February 2026

Published
10 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 2.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21323 is a high-severity Use After Free (CWE-416) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Timely patching of After Effects per Adobe bulletin APSB26-15 directly remediates the Use After Free vulnerability preventing arbitrary code execution.

prevent

Memory protection safeguards such as ASLR and DEP directly prevent exploitation of the Use After Free vulnerability for code execution.

preventdetect

Malicious code protection scans and blocks malicious files before they can be opened in After Effects, mitigating exploitation requiring user interaction.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Use-after-free in client app enables arbitrary code execution via malicious file opened by victim (T1203 Exploitation for Client Execution + T1204.002 Malicious File).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…

more

open a malicious file.

Deeper analysisAI

CVE-2026-21323 is a Use After Free vulnerability (CWE-416) affecting Adobe After Effects versions 25.6 and earlier. The flaw could result in arbitrary code execution in the context of the current user.

Exploitation requires user interaction, as a victim must open a malicious file. Local attackers with no privileges (PR:N) can leverage low-complexity (AC:L) techniques to achieve high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), earning a CVSS v3.1 base score of 7.8.

Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, addresses this vulnerability.

Details

CWE(s)

Affected Products

adobe
after effects
≤ 25.6.4

CVEs Like This One

CVE-2026-21326Same product: Adobe After Effects
CVE-2026-21351Same product: Adobe After Effects
CVE-2026-21320Same product: Adobe After Effects
CVE-2026-21329Same product: Adobe After Effects
CVE-2026-21327Same product: Adobe After Effects
CVE-2025-21159Same product: Apple Macos
CVE-2026-21330Same product: Adobe After Effects
CVE-2026-21328Same product: Adobe After Effects
CVE-2026-27277Same product: Apple Macos
CVE-2026-27283Same product: Apple Macos

References