Adobe After Effects: Out-of-bounds read leads to memory disclosure
Summary
A out-of-bounds read in Adobe After Effects can expose sensitive memory contents to an attacker. Exploitation requires a local user to open a malicious file, so the attacker must deliver the file, for example by email or a shared drive. Adobe rates the issue Medium (CVSS 5.5) and states it is not aware of any exploits in the wild.
Affected
- Adobe After Effects 26.5 and earlier (Windows and macOS)
- Adobe After Effects 25.6.6 and earlier (Windows and macOS)
Fixed in
- Adobe After Effects 26.5.3 for the 26.x branch
- Adobe After Effects 27.0 for the 25.x and newer branch
Workaround
Unknown. No vendor-documented workaround for this CVE. Install the update.
Exploitation
- Adobe is not aware of any exploits in the wild for the issues in bulletin APSB26-100.
- Zero Day Initiative lists the bulletin with exploited status 'No'.
- No public proof of concept found. CISA KEV status not verified.
Our recommendation
- Update After Effects to 26.5.3 or 27.0 within the normal desktop patch cycle.
- Patch sooner on workstations that open project or media files from external sources.
- Confirm the installed version on all workstations with After Effects.
- Install the full November 2026 update, not only this CVE.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Adobe Security Bulletin APSB26-100 www.adobe.com
- CVE Record CVE-2026-113514 www.cve.org
- Zero Day Initiative November 2026 security update review www.thezdi.com
- HKCERT Adobe monthly security update November 2026 www.hkcert.org
- Strix CVE-2026-113514 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 16:17.
Original description (NVD)
After Effects is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.