CVE-2024-47446: After Effects | Out-of-bounds Read (CWE-125)
First published: Tue Nov 12 2024(Updated: )
After Effects versions 23.6.9, 24.6.2 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Any of | ||
| Adobe After Effects | <=23.6.9 | |
| Adobe After Effects | >=24.0<24.6.3 | |
| Any of | ||
| Apple macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-47446?
CVE-2024-47446 is rated as a medium severity vulnerability due to the potential for sensitive memory disclosure.
How do I fix CVE-2024-47446?
To fix CVE-2024-47446, update Adobe After Effects to version 23.6.10 or 24.6.3 or later, which includes security patches.
Can CVE-2024-47446 be exploited remotely?
CVE-2024-47446 requires user interaction for exploitation, meaning a user must open a malicious file to trigger the vulnerability.
What versions of After Effects are affected by CVE-2024-47446?
CVE-2024-47446 affects Adobe After Effects versions 23.6.9, 24.6.2 and earlier.
Does CVE-2024-47446 affect macOS or Windows?
CVE-2024-47446 specifically impacts Adobe After Effects on macOS and Windows, but the operating systems themselves are not vulnerable.
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/severity
- agent/event
- agent/last-modified-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/tags
- agent/source
- vendor/adobe
- canonical/adobe after effects
- version/adobe after effects/23.6.9
- version/adobe after effects/24.0
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows