CVE-2021-28586: Adobe After Effects PDF file parsing out-of-bounds write could lead to remote code execution vulnerability

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-06-28 · updated 2026-06-17
Weakness: CWE-787

Description

After Effects version 18.0 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

Adobe After Effects: before 18.2 — fixed in 18.2

How to fix

Upgrade to a fixed version: Adobe After Effects 18.2. Check the vendor advisory for mitigations.

References

https://helpx.adobe.com/security/products/after_effects/apsb21-33.html
https://helpx.adobe.com/security/products/after_effects/apsb21-33.html

Get alerted when CVE-2021-28586 or the next vulnerability affects your stack