CVE-2024-47441: Adobe After Effects RCE Vulnerability

CVE-2024-47441 Overview

CVE-2024-47441 is an out-of-bounds write vulnerability [CWE-787] in Adobe After Effects. The flaw affects After Effects versions 23.6.9, 24.6.2, and earlier releases on both Windows and macOS. An attacker who convinces a user to open a crafted project file can achieve arbitrary code execution in the context of the current user. Exploitation requires local user interaction and no elevated privileges. Adobe published fixes in security advisory APSB24-85.

Critical Impact
Successful exploitation allows arbitrary code execution as the logged-in user, enabling malware installation, credential theft, and lateral movement from a workstation running Adobe After Effects.

Affected Products

Adobe After Effects 23.6.9 and earlier
Adobe After Effects 24.6.2 and earlier
Windows and macOS installations of the affected versions

Discovery Timeline

2024-11-12 - CVE-2024-47441 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47441

Vulnerability Analysis

CVE-2024-47441 is an out-of-bounds write flaw in Adobe After Effects file parsing routines. When After Effects processes a malformed project or asset file, the application writes data past the bounds of an allocated buffer. This memory corruption can be steered by an attacker to overwrite adjacent structures, function pointers, or return addresses. Successful exploitation leads to arbitrary code execution within the process. The code runs with the privileges of the user launching After Effects, which on typical creative workstations includes access to local documents, cached credentials, and network shares.

Root Cause

The root cause is insufficient bounds checking during parsing of untrusted file input. After Effects fails to validate the size or offset of an attacker-controlled field before writing into a fixed-size buffer. Out-of-bounds write conditions in media parsers commonly result from unchecked length values in file headers, integer truncation during size calculations, or incorrect assumptions about the layout of chunked container formats.

Attack Vector

Exploitation is local and requires user interaction. An attacker crafts a malicious .aep project file or supporting asset and delivers it through email, cloud collaboration, or a compromised project repository. The victim opens the file in a vulnerable version of After Effects, triggering the out-of-bounds write. Because attack complexity is low and no privileges are required, targeted phishing against media, marketing, and post-production teams is a realistic delivery method. No public proof-of-concept exploit is available at this time, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is publicly available. Refer to the Adobe After Effects Security Advisory for authoritative technical details.

Detection Methods for CVE-2024-47441

Indicators of Compromise

Unexpected child processes spawned by AfterFX.exe on Windows or After Effects on macOS, especially command shells, scripting hosts, or rundll32.exe
Crashes of After Effects immediately after opening a project file, recorded in Windows Event Log or macOS crash reports
Inbound .aep, .aet, or associated asset files from untrusted external senders opened on creative workstations

Detection Strategies

Monitor process ancestry for After Effects spawning interpreters such as powershell.exe, cmd.exe, wscript.exe, or bash
Alert on outbound network connections initiated directly by the After Effects process, which is uncommon during normal editing workflows
Correlate After Effects crash telemetry with subsequent process creation or file write activity on the same host

Monitoring Recommendations

Track installed After Effects build numbers across the fleet and flag hosts still running versions at or below 23.6.9 or 24.6.2
Log opens of project files delivered from email attachments, chat platforms, and unmanaged cloud storage
Retain endpoint telemetry for creative workstations at least 90 days to support retrospective hunts if new proof-of-concept exploits emerge

How to Mitigate CVE-2024-47441

Immediate Actions Required

Update Adobe After Effects to the fixed versions listed in Adobe advisory APSB24-85 on all Windows and macOS endpoints
Inventory creative workstations to confirm no instances of 23.6.9, 24.6.2, or earlier remain in production
Instruct users to open project files only from trusted sources and to verify origin before double-clicking attachments

Patch Information

Adobe released fixes in security bulletin APSB24-85. Details, download links, and the full list of patched versions are available in the Adobe After Effects Security Advisory. Deploy updates through the Adobe Creative Cloud desktop application or your managed software distribution channel.

Workarounds

Block inbound .aep and .aet attachments at the email gateway when business processes allow
Restrict After Effects users to standard, non-administrative accounts to limit the impact of code execution
Apply application allowlisting so that unexpected child processes launched from After Effects are blocked

bash

# Query installed After Effects version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe After Effects*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate