For managed environments, IT administrators can use the Admin Console to deploy Creative Cloud applications to end users. Refer to this help page for more information.
Adobe Security Bulletin
Last updated on Feb 17, 2026
Security Updates Available for Adobe After Effects | APSB26-15
Bulletin ID
Date published
Priority
ASPB26-15
February 10, 2026
3
Summary
Adobe has released an update for Adobe After Effects for Windows and macOS. This update addresses critical and important security vulnerabilities. Successful exploitation could lead to arbitrary code execution, memory exposure, and application denial-of-service.
Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.
Affected versions
Product
Version
Platform
Adobe After Effects
25.6 and earlier versions
Windows and macOS
Solution
Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version via the Creative Cloud desktop app's update mechanism. For more information, please reference this help page.
Product
Version
Platform
Priority rating
Availability
Vulnerability Details
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21318
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21320
Integer Overflow or Wraparound (CWE-190)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21321
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21322
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21323
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21324
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21325
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21326
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21327
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21328
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21329
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21330
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-21351
NULL Pointer Dereference (CWE-476)
Application denial-of-service
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2026-21350
Out-of-bounds Read (CWE-125)
Memory exposure
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2026-21319
Acknowledgements
Adobe would like to thank the following for reporting the relevant issues and for working with Adobe to help protect our customers:
- voidexploit -- CVE-2026-21318, CVE-2026-21350
- yjdfy -- CVE-2026-21320, CVE-2026-21321, CVE-2026-21322, CVE-2026-21323, CVE-2026-21324, CVE-2026-21325, CVE-2026-21326, CVE-2026-21327, CVE-2026-21328, CVE-2026-21329, CVE-2026-21330
- Francis Provencher (prl) -- CVE-2026-21351, CVE-2026-21319
NOTE: Adobe has a public bug bounty program. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail
For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com.
CardTitle
APSB26-15
CardDescription
Priority 3 Security update
CardImage
Created
2026-02-10
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/after-effects
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/after-effects
Arbitrary
search: CVE-2026-21318 CVE-2026-21320 CVE-2026-21321 CVE-2026-21322 CVE-2026-21323 CVE-2026-21324 CVE-2026-21325 CVE-2026-21326 CVE-2026-21327 CVE-2026-21328 CVE-2026-21329 CVE-2026-21330 CVE-2026-21351 CVE-2026-21350 CVE-2026-21319
