CVE-2025-47109: Adobe After Effects DOS Vulnerability

CVE-2025-47109 Overview

CVE-2025-47109 is a NULL Pointer Dereference vulnerability [CWE-476] affecting Adobe After Effects versions 25.2, 24.6.6, and earlier on Windows and macOS. An attacker can craft a malicious project file that triggers a null pointer dereference when opened, causing the application to crash. Exploitation requires user interaction because a victim must open the malicious file locally. Successful exploitation results in denial-of-service by terminating the After Effects process. The vulnerability does not permit code execution or information disclosure. Adobe addressed the issue in Security Bulletin APSB25-49.

Critical Impact
A malicious After Effects file can crash the application on Windows and macOS workstations, disrupting media production workflows.

Affected Products

Adobe After Effects 25.2 and earlier
Adobe After Effects 24.6.6 and earlier
Microsoft Windows and Apple macOS installations of the affected versions

Discovery Timeline

2025-07-08 - CVE-2025-47109 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47109

Vulnerability Analysis

The flaw is a NULL Pointer Dereference [CWE-476] within Adobe After Effects file parsing logic. When After Effects processes a specially crafted project or asset file, the application dereferences a pointer that was never initialized or was set to NULL following an earlier parsing failure. The resulting access violation terminates the process. Because the vulnerability is triggered locally and depends on the victim opening the file, the practical impact is limited to availability of the After Effects application. There is no evidence of exploitation in the wild, and no public proof-of-concept exists.

Root Cause

The root cause is missing validation of a pointer returned by an internal file-handling routine. When malformed or unexpected structures appear in an input file, the routine returns a null reference that downstream code consumes without a null check. Subsequent read or write access to that reference triggers an unhandled exception and terminates the process.

Attack Vector

Exploitation requires local file access and active user interaction. An attacker distributes a crafted After Effects file through phishing, shared project repositories, or third-party template marketplaces. When the victim opens the file in a vulnerable version of After Effects, the application crashes. The attack cannot be triggered remotely without user action and does not grant the attacker code execution or elevated privileges on the host system.

No verified exploit code is publicly available. See the Adobe advisory referenced in the mitigation section for vendor details.

Detection Methods for CVE-2025-47109

Indicators of Compromise

Repeated unexpected termination of AfterFX.exe on Windows or After Effects on macOS shortly after opening a project file.
Windows Application Event Log entries showing access violation exceptions in After Effects with faulting module references.
macOS crash reports under ~/Library/Logs/DiagnosticReports/ naming After Effects with EXC_BAD_ACCESS (SIGSEGV).
Delivery of .aep, .aet, or related After Effects asset files from untrusted email senders or file-sharing links.

Detection Strategies

Alert on process termination events for After Effects immediately following a file-open action initiated from a browser download or email attachment folder.
Correlate crash telemetry with the source path of the opened file to identify suspicious delivery vectors.
Inspect endpoint software inventory to identify After Effects installations at or below versions 25.2 and 24.6.6.

Monitoring Recommendations

Ingest Windows Application and macOS unified logs into a centralized log platform to track After Effects crash frequency and origin.
Track email and web gateway telemetry for delivery of After Effects project files from external senders.
Baseline normal After Effects process lifetime and alert on statistically anomalous crash bursts across users.

How to Mitigate CVE-2025-47109

Immediate Actions Required

Upgrade Adobe After Effects to the fixed versions listed in Adobe Security Bulletin APSB25-49.
Inventory endpoints running After Effects 25.2, 24.6.6, or earlier and prioritize creative workstations for patching.
Instruct users to avoid opening After Effects project files received from untrusted or unverified sources.

Patch Information

Adobe released fixes for CVE-2025-47109 in Security Bulletin APSB25-49. Apply the updates through the Adobe Creative Cloud desktop application or via managed deployment tooling for enterprise environments.

Workarounds

Restrict opening of After Effects project files to those originating from trusted internal sources until patches are deployed.
Enforce email attachment filtering rules that quarantine .aep and .aet files from external senders.
Use application allowlisting to ensure only the approved After Effects version is executable on managed endpoints.

bash

# Query installed After Effects version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Adobe\After Effects\*" | Select-Object DisplayName, Version