CVE-2024-47443: Adobe After Effects RCE Vulnerability

CVE-2024-47443 Overview

CVE-2024-47443 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe After Effects versions 23.6.9, 24.6.2, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted project file. Exploitation requires user interaction, and the attack vector is local. Adobe published fixes in security bulletin APSB24-85.

Critical Impact
A successful exploit yields arbitrary code execution with the privileges of the user running After Effects, enabling full compromise of the user session on Windows or macOS hosts.

Affected Products

Adobe After Effects 23.6.9 and earlier
Adobe After Effects 24.6.2 and earlier
Microsoft Windows and Apple macOS installations of the affected versions

Discovery Timeline

2024-11-12 - CVE-2024-47443 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47443

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe After Effects file parsing. When After Effects processes a malformed project or media file, the application writes attacker-controlled data past the bounds of an allocated buffer. That write can corrupt adjacent memory structures such as function pointers, vtables, or heap metadata. An attacker who controls the corrupted memory can redirect execution to attacker-supplied code.

Exploitation runs in the security context of the invoking user. On workstations used by media production teams, that user often holds elevated privileges to storage, cloud sync tools, and code-signing artifacts. The result is a foothold suitable for credential theft, lateral movement, or ransomware staging.

Root Cause

The root cause is missing or insufficient bounds checking on data read from a file. The parser trusts a size, offset, or count field embedded in the input without validating it against the destination buffer. Adobe categorized the flaw under CWE-787 (Out-of-bounds Write) in advisory APSB24-85.

Attack Vector

Delivery is client-side. An attacker crafts a malicious After Effects project (.aep) or associated media asset and delivers it through phishing, a shared production pipeline, a compromised asset marketplace, or a collaborative storage share. The victim must open the file in After Effects to trigger the flaw. No network access to the host is required, and no prior authentication to the application is needed.

See the Adobe Security Advisory APSB24-85 for vendor technical details.

Detection Methods for CVE-2024-47443

Indicators of Compromise

After Effects (AfterFX.exe on Windows, After Effects on macOS) spawning shell interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Unexpected child processes writing to %APPDATA%, %TEMP%, or ~/Library/Application Support/ shortly after a project file is opened.
After Effects making outbound network connections to non-Adobe infrastructure immediately after opening an untrusted asset.

Detection Strategies

Hunt for process-tree anomalies where After Effects is the parent of a scripting host or LOLBin.
Correlate file-open telemetry for .aep, .aet, and imported media formats with subsequent process creation and file-write events.
Alert on crash telemetry for After Effects that includes access-violation exceptions on write, which can indicate exploitation attempts.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake and retain project-open events for retrospective hunting.
Track version inventory for After Effects across managed endpoints and flag hosts running 23.6.9, 24.6.2, or earlier.
Monitor download and email gateways for After Effects project files originating from untrusted senders or external file shares.

How to Mitigate CVE-2024-47443

Immediate Actions Required

Upgrade Adobe After Effects to the fixed builds listed in APSB24-85 on all Windows and macOS endpoints.
Restrict opening of After Effects project files received from external or untrusted sources until patching is complete.
Run After Effects under standard user accounts, not local administrators, to limit post-exploitation impact.

Patch Information

Adobe released fixed versions in security bulletin Adobe Security Advisory APSB24-85. Administrators should deploy the update through the Creative Cloud desktop application or enterprise deployment tooling such as the Adobe Admin Console.

Workarounds

Block inbound .aep and .aet attachments at the email gateway pending patch deployment.
Isolate production workstations that must process third-party project files on a segmented VLAN with restricted egress.
Enable application allowlisting to prevent After Effects from launching unauthorized child processes.

bash

# Verify installed After Effects version on macOS
defaults read "/Applications/Adobe After Effects 2024/Adobe After Effects 2024.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed After Effects version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*After Effects*" } |
  Select-Object DisplayName, DisplayVersion