CVE-2026-21325
Published: 10 February 2026
Summary
CVE-2026-21325 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 4.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21325 is an out-of-bounds read vulnerability (CWE-125) affecting Adobe After Effects versions 25.6 and earlier. The flaw arises when parsing a crafted file, which could result in a read past the end of an allocated memory structure. Published on 2026-02-10, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires an attacker to have local access to the target system with low complexity and no privileges, but necessitates user interaction as the victim must open a malicious file. Successful exploitation allows arbitrary code execution in the context of the current user, potentially leading to high impacts on confidentiality, integrity, and availability.
Adobe's security bulletin APSB26-15 provides details on mitigations and patches: https://helpx.adobe.com/security/products/after_effects/apsb26-15.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6375
Vulnerability details
After Effects versions 25.6 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute…
more
code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in file parser directly enables RCE via crafted malicious file opened by user (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely patching of the out-of-bounds read vulnerability in After Effects versions 25.6 and earlier as provided in Adobe's APSB26-15 security bulletin.
Implements memory safeguards like ASLR and DEP to prevent arbitrary code execution from the out-of-bounds read past allocated memory structures.
Enables vulnerability scanning to identify systems running vulnerable After Effects versions affected by this CVE.