CVE-2026-21351
Published: 10 February 2026
Summary
CVE-2026-21351 is a high-severity Use After Free (CWE-416) vulnerability in Adobe After Effects. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 2.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-21351 is a Use After Free vulnerability (CWE-416) affecting Adobe After Effects versions 25.6 and earlier. Published on 2026-02-10, it could result in arbitrary code execution in the context of the current user. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Exploitation requires user interaction, as a victim must open a malicious file. A local attacker with no privileges required can leverage low attack complexity to trigger the issue, achieving high impacts on confidentiality, integrity, and availability through arbitrary code execution.
Adobe's security bulletin APSB26-15, available at https://helpx.adobe.com/security/products/after_effects/apsb26-15.html, details patches and mitigation recommendations for this vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-6364
Vulnerability details
After Effects versions 25.6 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in client app directly enables client-side exploitation via malicious file opened by user, leading to arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the Use After Free vulnerability by requiring identification, reporting, and timely patching of flaws in After Effects as detailed in Adobe's security bulletin.
Implements memory protections such as DEP and ASLR to prevent arbitrary code execution resulting from the Use After Free error upon opening malicious files.
Enables detection of vulnerable After Effects versions through regular vulnerability scanning, facilitating proactive remediation.