Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the context of the current user. User interaction is required in that the victim must open a specially crafted file to exploit this vulnerability.

The version of Adobe After Effects installed on the remote macOS host is prior to 18.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-79 advisory.

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40759, CVE-2021-40760)

  - Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40751, CVE-2021-40752)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40753)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40754, CVE-2021-40758)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SGI file in the DoReadContinue function, potentially resulting in     arbitrary code execution in the context of the current user. User interaction is required to exploit this     vulnerability. (CVE-2021-40755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Adobe After Effects installed on the remote Windows host is prior to 18.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-79 advisory.

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40759, CVE-2021-40760)

  - Adobe After Effects version 18.4 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious .m4a file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40751, CVE-2021-40752)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SVG file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40753)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious WAV file, potentially resulting in arbitrary code execution in the     context of the current user. User interaction is required in that the victim must open a specially crafted     file to exploit this vulnerability. (CVE-2021-40754, CVE-2021-40758)

  - Adobe After Effects version 18.4.1 (and earlier) is affected by a memory corruption vulnerability due to     insecure handling of a malicious SGI file in the DoReadContinue function, potentially resulting in     arbitrary code execution in the context of the current user. User interaction is required to exploit this     vulnerability. (CVE-2021-40755)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
209422	Adobe After Effects < 18.4.2 Multiple Vulnerabilities (APSB21-79) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
154713	Adobe After Effects < 18.4.2 Multiple Vulnerabilities (APSB21-79)	Nessus	Windows	Local	high

Detections

Analytics

CVE-2021-40754

high

Tenable Plugins

high

high