CVE-2021-28587: 
Adobe After Effects vulnerability analysis and mitigation

Adobe After Effects versions 18.0 and earlier were affected by an out-of-bounds read vulnerability identified as CVE-2021-28587. The vulnerability was discovered and assigned on March 16, 2021, and was publicly disclosed on June 28, 2021. This security flaw affects Adobe After Effects software running on Microsoft Windows systems (CVE Details).

The vulnerability is classified as an out-of-bounds read issue (CWE-125) that could potentially expose sensitive memory information. The severity assessment varies between sources, with NIST NVD assigning a CVSS v3.1 Base Score of 3.3 (LOW) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, while Adobe Systems rated it with a CVSS v3.0 Base Score of 4.3 (MEDIUM) with vector CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (NVD).

The vulnerability could lead to the disclosure of sensitive memory information, potentially allowing attackers to bypass security mitigations such as Address Space Layout Randomization (ASLR). This type of vulnerability could expose sensitive data stored in memory, potentially compromising system security (CVE Details).

Exploitation of this vulnerability requires user interaction, specifically requiring a victim to open a malicious file. The local attack vector and the requirement for user interaction somewhat limit the ease of exploitation (NVD).

Adobe addressed this vulnerability in After Effects version 18.2. Users running version 18.0 or earlier versions should upgrade to version 18.2 or later to mitigate this security risk (Adobe Advisory).