CVE-2024-47442: Adobe After Effects RCE Vulnerability

CVE-2024-47442 Overview

CVE-2024-47442 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe After Effects versions 23.6.9, 24.6.2, and earlier. The flaw allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction, as the victim must open a malicious file crafted by the attacker. Adobe published the corresponding security advisory (APSB24-85) on November 12, 2024.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-in user, enabling malware installation, credential theft, and lateral movement from a workstation running After Effects.

Affected Products

Adobe After Effects 23.6.9 and earlier
Adobe After Effects 24.6.2 and earlier
Windows and macOS installations of Adobe After Effects

Discovery Timeline

2024-11-12 - CVE-2024-47442 published to NVD
2024-11-12 - Adobe releases security advisory APSB24-85
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47442

Vulnerability Analysis

CVE-2024-47442 is classified as an out-of-bounds write [CWE-787]. After Effects writes data past the boundary of an allocated buffer while parsing a crafted project or media file. Attackers can leverage this memory corruption primitive to overwrite adjacent memory structures, including function pointers or object metadata, and redirect execution flow.

The vulnerability is exploitable locally and requires user interaction. Attackers typically deliver malicious .aep, .aet, or supported media files through phishing, shared collaboration workflows, or compromised asset marketplaces. Once opened in After Effects, the malformed file triggers the flawed parsing routine.

Code execution runs at the privilege level of the user account running After Effects. On workstations where content creators operate with administrative rights, the impact extends to full system compromise. The EPSS score is 0.311% with a percentile of 23.774, reflecting limited observed exploitation activity to date.

Root Cause

The root cause is missing or insufficient bounds checking during the deserialization of file structures. When the application processes attacker-controlled length or offset fields, it writes data beyond the intended buffer, corrupting heap or stack memory.

Attack Vector

The attack vector is local and file-based. An attacker crafts a malicious project or asset file and delivers it to the target through email attachments, cloud storage, or third-party template sites. Opening the file in a vulnerable version of After Effects triggers the out-of-bounds write and subsequent code execution.

No verified public proof-of-concept code is available for CVE-2024-47442. See the Adobe After Effects Security Advisory (APSB24-85) for vendor technical details.

Detection Methods for CVE-2024-47442

Indicators of Compromise

Unexpected child processes spawned by AfterFX.exe on Windows or After Effects.app on macOS, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
After Effects process crashes or exception events immediately following the opening of externally sourced project files.
Outbound network connections initiated by the After Effects process to previously unseen domains or IP addresses.

Detection Strategies

Monitor endpoint telemetry for process lineage anomalies where After Effects is the parent of scripting engines, LOLBins, or persistence utilities.
Alert on file write activity by After Effects to autostart locations, scheduled task paths, or user startup folders.
Track inventory of installed After Effects versions and flag hosts running builds at or below 23.6.9 and 24.6.2.

Monitoring Recommendations

Enable command-line auditing and PowerShell script block logging on creative workstations to capture post-exploitation activity.
Ingest Adobe application crash logs into a central log platform to correlate crash bursts with malicious file delivery.
Baseline normal After Effects network behavior and alert on deviations, including connections to file-sharing or paste sites.

How to Mitigate CVE-2024-47442

Immediate Actions Required

Update Adobe After Effects to the fixed versions identified in Adobe advisory APSB24-85 on all Windows and macOS endpoints.
Restrict opening After Effects project and asset files received from untrusted sources until patching is complete.
Run After Effects under standard user accounts rather than accounts with local administrator privileges to limit blast radius.

Patch Information

Adobe addressed CVE-2024-47442 in the security update published as APSB24-85. Users on the 23.x branch must upgrade beyond 23.6.9, and users on the 24.x branch must upgrade beyond 24.6.2. Deploy the update through the Adobe Creative Cloud desktop application or enterprise deployment tooling.

Workarounds

Block inbound delivery of After Effects project files (.aep, .aet) at email and web gateways for users who do not require them.
Apply application allowlisting to prevent After Effects from launching unapproved child processes such as command shells.
Segment creative workstations from sensitive corporate resources to contain post-exploitation lateral movement.

bash

# Verify installed After Effects version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*After Effects*" } |
  Select-Object DisplayName, DisplayVersion, Publisher