CVE-2026-21327

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21327", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2025-12-12T22:01:18.194Z", "datePublished": "2026-02-10T17:52:56.262Z", "dateUpdated": "2026-08-27T22:02:29.955Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "After Effects", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6.4", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}], "datePublic": "2026-02-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 7.8, "environmentalSeverity": "HIGH", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "HIGH", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 7.8, "temporalSeverity": "HIGH", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "Out-of-bounds Write (CWE-787)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:29.955Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/after_effects/apsb26-15.html"}], "source": {"discovery": "EXTERNAL"}, "title": "After Effects | Out-of-bounds Write (CWE-787)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:39.298774Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:36.784Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21327", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T04:56:39.298774Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T15:42:25.426Z"}}], "cna": {"title": "After Effects | Out-of-bounds Write (CWE-787)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "modifiedScope": "UNCHANGED", "temporalScore": 7.8, "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "HIGH", "availabilityImpact": "HIGH", "environmentalScore": 7.8, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "HIGH", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "After Effects", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "25.6"}, {"status": "unaffected", "version": "25.6.4", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/after_effects/apsb26-15.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write (CWE-787)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:29.955Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21327", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:02:29.955Z", "dateReserved": "2025-12-12T22:01:18.194Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-02-10T17:52:56.262Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "After Effects", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "25.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "25.6.4", "versionType": "semver"}, {"status": "unaffected", "version": "26.0", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:after_effects:*:*:*:*:*:*:*:*", "matchCriteriaId": "F65542CB-5428-49D9-818B-F08F7BA9776F", "versionEndExcluding": "25.6.4", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "After Effects versions 25.6 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Versiones 25.6 y anteriores de After Effects est\u00e1n afectadas por una vulnerabilidad de escritura fuera de l\u00edmites que podr\u00eda resultar en ejecuci\u00f3n de c\u00f3digo arbitrario en el contexto del usuario actual. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-21327", "lastModified": "2026-08-28T00:16:56.583", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21327", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T04:56:39.298774Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:30.530", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/after_effects/apsb26-15.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,25.6]"}}], "product": "after_effects", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-17T20:40:05.642658+00:00", "value": {"mitigation_remediation": ["Upgrade Adobe After\u202fEffects to version 26.0 or later to receive the vendor\u2011issued fix for the out\u2011of\u2011bounds write flaw.", "Enable and enforce automatic updates for Adobe applications so that future security patches are applied without manual intervention.", "Restrict file types that can be opened by After\u202fEffects by implementing a trusted repository or quarantine mechanism, ensuring only vetted files are processed.", "If an immediate upgrade cannot be performed, run After\u202fEffects within a sandbox or virtual machine to isolate the application from the host system until the patch is applied."], "summary": {"action": "Apply Patch", "impact": "Arbitrary code execution"}, "threat_synthesis": {"affected_systems": "Adobe After\u202fEffects, versions 25.6 and earlier, running on both macOS and Windows platforms. The affected binaries are the standard installation packages available from Adobe\u2019s distribution channels.", "description_and_impact": "After Effects versions 25.6 and earlier contain an out\u2011of\u2011bounds write flaw that can be triggered when a user opens a specially crafted file. The vulnerability can lead to arbitrary code execution running under the privileges of the currently logged\u2011in user, potentially allowing an attacker to compromise the machine, exfiltrate data, or install malware.", "risk_and_exploitability": "The risk is quantified by a CVSS score of 7.8, indicating moderate to high severity. However, the EPSS score is below 1\u202f%, suggesting a low probability of real\u2011world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a victim to open a malicious file, so the attack vector is user interaction with a document, making it a typical spear\u2011phishing or social engineering scenario."}}}}, "created": "2026-02-10T21:33:37.504973+00:00", "updated": "2026-04-17T20:45:25.768849+00:00", "vendors": ["adobe", "adobe$PRODUCT$after_effects"]}