CVE-2026-21324
Published: 10 February 2026
Summary
CVE-2026-21324 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-21324 is an out-of-bounds read vulnerability (CWE-125) affecting Adobe After Effects versions 25.6 and earlier. The flaw occurs when parsing a crafted file, resulting in a read past the end of an allocated memory structure. This issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), rated as high severity.
An attacker with local access can exploit this vulnerability by tricking a victim into opening a malicious file, as user interaction is required. Successful exploitation allows arbitrary code execution in the context of the current user, potentially leading to high impacts on confidentiality, integrity, and availability.
Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, provides details on the vulnerability and recommended mitigations, including available patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6376
Vulnerability details
After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute…
more
code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read during crafted file parsing directly enables RCE via malicious file opened by user (T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds read vulnerability by requiring timely installation of Adobe-provided patches for After Effects versions 25.6 and earlier.
Memory protection mechanisms like ASLR, DEP, and stack canaries mitigate exploitation of the out-of-bounds read to achieve arbitrary code execution.
Vulnerability scanning identifies systems with vulnerable After Effects installations affected by this specific CVE, enabling targeted remediation.