CVE-2025-27204
published 2025-04-08CVE-2025-27204: After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An…
PriorityP425medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.32%
23.4th percentile
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | after_effects | < 24.6.5 | 24.6.5 |
| adobe | after_effects | <= 24.6.4 | — |
| adobe | after_effects | >= 25.0 < 25.2 | 25.2 |
| vllm | vllm | >= 0.10.2 < 0.13.0 | 0.13.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
ghsa8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
vLLM introduced enhanced protection for CVE-2025-62164
ghsa·2026-01-08·CVSS 8.8
CVE-2025-62164 [HIGH] CWE-123 vLLM introduced enhanced protection for CVE-2025-62164
vLLM introduced enhanced protection for CVE-2025-62164
### Summary
The fix [here](https://github.com/vllm-project/vllm/pull/27204) for CVE-2025-62164 is not sufficient. The fix only disables prompt embeds by default rather than addressing the root cause, so the DoS vulnerability remains when the feature is enabled.
### Details
vLLM's pending change attempts to fix the root cause, which is the missing sparse tensor validation. PyTorch (~v2.0) disables sparse tensor validation (specifically, sparse tensor invariants checks) by default for performance reasons. vLLM is adding the sparse tensor validation to ensure indices are valid, non-negative, and within bounds. These checks help catch malformed tensors.
### PoC
NA
### Impact
Current fix only added a flag to disable/enable prompt embeds
GHSA
GHSA-p5rh-8pxf-mm32: After Effects versions 25
ghsa_unreviewed·2025-04-08
CVE-2025-27204 [MEDIUM] CWE-125 GHSA-p5rh-8pxf-mm32: After Effects versions 25
After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-04-08
Published