CVE-2021-40759: Adobe After Effects M4A File Parsing Memory Corruption Arbitrary Code Execution
Published Nov 18, 2021
·Updated
Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.
Affected Software
2 affected components
Adobe After Effects<=18.4.1
Microsoft Windows
Remediation
Event History
Nov 18, 2021
CVE Published
via MITRE·04:26 PM
Data Sourced
via MITRE·04:26 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2021-40759.
2
Which software is affected by this vulnerability?
Adobe After Effects version 18.4.1 (and earlier) is affected.
3
What is the severity rating of this vulnerability?
The severity rating of this vulnerability is 7.8 (Critical).
4
How can this vulnerability be exploited?
This vulnerability can be exploited by opening a malicious .m4a file, which can result in arbitrary code execution.
5
Is user interaction required to exploit this vulnerability?
Yes, user interaction is required. The victim must open a specific file for the vulnerability to be exploited.