Listen to this Post
How the CVE Works
CVE-2025-47109 is a NULL pointer dereference vulnerability in Adobe After Effects versions 25.2, 24.6.6, and earlier. When a maliciously crafted project file is opened, the application fails to handle a NULL pointer check during memory access. This leads to an abrupt crash due to an invalid memory dereference. Attackers can exploit this by tricking a user into opening a specially crafted .aep file, causing denial-of-service. The flaw resides in the file parsing module, where improper validation occurs before processing project assets.
DailyCVE Form
Platform: Adobe After Effects
Version: 25.2, 24.6.6
Vulnerability: NULL Pointer Dereference
Severity: Medium
Date: 07/14/2025
Prediction: Patch by 08/15/2025
What Undercode Say
Analytics:
grep -r "NULL deref" /opt/adobe/after_effects/modules
void parse_project_file(FILE fp) {
Asset asset = NULL;
// Missing NULL check before access
load_asset_data(asset->data); // Crash here
}
Exploit:
Malicious .aep file triggers crash via unhandled NULL pointer.
Protection from this CVE:
Update to patched version. Disable untrusted project files.
Impact:
Application crash, workflow disruption.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
