CVE-2023-47071: 
Adobe After Effects vulnerability analysis and mitigation

Adobe After Effects versions 24.0.2 (and earlier) and 23.6 (and earlier) are affected by an out-of-bounds read vulnerability identified as CVE-2023-47071. The vulnerability was disclosed on November 17, 2023, and could potentially lead to disclosure of sensitive memory (NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) with a CVSS v3.1 base score of 5.5 (Medium). The vulnerability has the following characteristics: Attack Vector (AV): Local, Attack Complexity (AC): Low, Privileges Required (PR): None, User Interaction (UI): Required, Scope (S): Unchanged, Confidentiality Impact (C): High, Integrity Impact (I): None, Availability Impact (A): None (Adobe Advisory).

The vulnerability could lead to disclosure of sensitive memory and could potentially be leveraged by an attacker to bypass security mitigations such as ASLR (Address Space Layout Randomization). The exploitation requires user interaction, specifically opening a malicious file (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe After Effects (Adobe Advisory).