CVE-2026-34644: Adobe After Effects RCE Vulnerability

CVE-2026-34644 Overview

CVE-2026-34644 is an integer overflow vulnerability [CWE-190] affecting Adobe After Effects versions 26.0, 25.6.4, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. Exploitation requires user interaction, which lowers the risk of mass exploitation but remains a viable vector for targeted attacks and social engineering campaigns against media and post-production environments.

Adobe published advisory APSB26-48 to address the issue. No public proof-of-concept is available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at the time of publication.

Critical Impact
A successful exploit grants arbitrary code execution under the current user's privileges, enabling malware installation, credential theft, and lateral movement from creative workstations.

Affected Products

Adobe After Effects 26.0
Adobe After Effects 25.6.4 and earlier
Both Windows and macOS installations of the affected versions

Discovery Timeline

2026-05-12 - CVE-2026-34644 published to the National Vulnerability Database
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-34644

Vulnerability Analysis

The vulnerability is an integer overflow or wraparound condition [CWE-190] in Adobe After Effects file parsing logic. When After Effects processes a project, composition, or media file, arithmetic operations on size or length fields can exceed the maximum value of the destination integer type. The wrap-around result is then used to allocate or index into a buffer.

The undersized allocation that follows leads to subsequent writes overflowing adjacent memory. Attackers control the overflowed data and can corrupt object pointers, function tables, or return addresses. This corruption transforms a memory-safety bug into reliable arbitrary code execution.

The attack vector is local and the attack complexity is low, but user interaction is required. The scope remains unchanged, while confidentiality, integrity, and availability impacts are all high because code runs with the logged-in user's full privileges.

Root Cause

The root cause is missing validation of size or count values before arithmetic operations during file parsing. After Effects supports complex container formats with nested structures, and an attacker-supplied length field can be multiplied or added to other values without bounds checking. The resulting wrap-around produces a small allocation followed by a large write.

Attack Vector

An attacker crafts a malicious After Effects project file, plugin, or media asset containing the trigger values. The file is delivered through email, shared project repositories, freelancer handoffs, or compromised stock-asset marketplaces. When the victim opens the file in a vulnerable version of After Effects, the parser triggers the overflow and executes the embedded payload.

No verified exploitation code is publicly available. See the Adobe After Effects Security Advisory APSB26-48 for vendor-supplied technical context.

Detection Methods for CVE-2026-34644

Indicators of Compromise

After Effects (AfterFX.exe on Windows, Adobe After Effects on macOS) spawning command shells such as cmd.exe, powershell.exe, or /bin/sh
Unexpected child processes performing network connections, persistence writes, or credential access from the After Effects process tree
After Effects crash dumps referencing heap corruption shortly after opening a project file received from an untrusted source
Project files (.aep, .aepx) or imported media arriving from external senders followed by anomalous process activity

Detection Strategies

Build behavioral rules that alert when Adobe Creative Cloud applications spawn scripting interpreters or system utilities
Hunt for After Effects writing executables, scheduled tasks, or LaunchAgent files to disk
Correlate file-open telemetry on .aep and .aepx files with subsequent process or network anomalies
Track installed After Effects build numbers across endpoints to surface unpatched workstations

Monitoring Recommendations

Forward endpoint process, file, and network telemetry to a centralized analytics platform for retroactive hunting
Alert on outbound connections from After Effects to non-Adobe domains, especially raw IP destinations
Monitor email and file-sharing gateways for inbound After Effects project archives from external parties

How to Mitigate CVE-2026-34644

Immediate Actions Required

Update Adobe After Effects to the fixed version listed in advisory APSB26-48 on all Windows and macOS workstations
Inventory creative endpoints to confirm no instances of version 26.0 or 25.6.4 and earlier remain in use
Instruct artists and editors to refuse project files from unverified senders until patching is complete
Restrict After Effects users to standard, non-administrative accounts to limit post-exploitation impact

Patch Information

Adobe addressed CVE-2026-34644 in the security update referenced by the Adobe After Effects Security Advisory APSB26-48. Apply the update through the Adobe Creative Cloud desktop application or enterprise deployment tooling. Verify the installed version after patching matches or exceeds the fixed build documented in the advisory.

Workarounds

Disable opening of After Effects project files received from external or untrusted sources until the patch is deployed
Open suspicious project files only inside an isolated virtual machine without access to corporate resources or credentials
Apply application allow-listing to prevent child processes such as shells or script interpreters from launching under After Effects
Use email and file-gateway controls to quarantine inbound .aep and .aepx attachments pending review

bash

# Verify After Effects version on macOS
defaults read "/Applications/Adobe After Effects 2026/Adobe After Effects 2026.app/Contents/Info.plist" CFBundleShortVersionString

# Verify After Effects version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe After Effects*" } |
  Select-Object DisplayName, DisplayVersion