Fade In
CVE-2025-53855
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious .fadein file
-
DeliveryDeliver file to victim via email/share
-
ExploitVictim opens file in Fade In
-
ExecutionTrigger out-of-bounds write in XML parser
-
ImpactExecute arbitrary code in user context
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied, specially crafted .fadein file in Fade In 4.2.0; the malformed XML content triggers the out-of-bounds write in the application's XML parser. The limiting factor is mandatory user interaction (UI:R) combined with a local attack vector (AV:L) - there is no network-reachable component, so the attacker must successfully deliver the file and persuade the user to open it. Code execution is confined to the privileges of the user running the application. |
| Impact | This is a legitimate memory-corruption flaw but a lower operational priority than its 7.8 'High' CVSS implies. The CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a LOCAL, user-interaction-dependent attack: despite PR:N (no privileges needed), exploitation is gated by UI:R, meaning a victim must be convinced to open a malicious .fadein file - this is a file-format vulnerability, not a remotely reachable network service. EPSS is low at 0.34% (25th percentile), which is consistent with a client-side file parser in a niche product that attackers are unlikely to exploit at scale. A public POC exists (Cisco Talos, TALOS-2025-2250), so exploit code availability raises the floor on attacker effort, but there is NO CISA KEV listing and no evidence of active exploitation. Signals are internally consistent - no contradictions between the vector, EPSS, and POC status - and point to a targeted social-engineering scenario rather than mass exploitation. Technical impact is high (full C/I/A compromise of the user context running the application). Net: patch during normal cycles; prioritize only for users who routinely open untrusted .fadein files. |
| Exploit ScenarioDerived | An attacker crafts a malicious .fadein screenplay file and delivers it to a victim via email, a shared drive, or a screenwriting collaboration channel. When the victim opens the file in Fade In 4.2.0, the XML parser performs an out-of-bounds write, corrupting memory and enabling arbitrary code execution in the victim's user context. A public proof-of-concept exists (Cisco Talos TALOS-2025-2250), and the local vector with required user interaction means success hinges on social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Out-of-bounds write in the XML parsing component of GCC Productions' Fade In 4.2.0 lets an attacker corrupt memory on a target system when a victim opens a specially crafted .fadein project file. Because the flaw is triggered by parsing malformed XML content, successful exploitation depends entirely on user interaction - the victim must be persuaded to open an attacker-supplied file - and code execution is confined to the privileges of the user running Fade In (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 High). Publicly available exploit code exists per the Talos vulnerability report TALOS-2025-2250, but EPSS is low at 0.34% (25th percentile) and there is no evidence of confirmed active exploitation (CISA KEV), so this is a legitimate memory-corruption bug that is a lower operational priority than its High score suggests.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so confirm the current status directly with GCC Productions and monitor the Talos advisory TALOS-2025-2250 (https://talosintelligence.com/vulnerability_reports/TALOS-2025-2250) for an updated release; if a patched build of Fade In appears, upgrading beyond 4.2.0 is the primary and most complete fix. Until then, treat .fadein files as untrusted content: block or quarantine .fadein attachments at the email and web gateways and strip them from downloads (trade-off: legitimate collaboration via email is disrupted, so route shared projects through a trusted internal repository instead), and instruct users never to open project files from unknown or unsolicited sources. For high-risk users, run Fade In inside a sandboxed or low-privilege environment or a disposable VM so that any memory corruption and subsequent code execution is contained to that isolated context (trade-off: reduced convenience, no access to host document templates or network shares, and file save/load workflows must be adapted). Keep host-based exploit mitigations such as ASLR and DEP enabled to raise the difficulty of turning the out-of-bounds write into reliable code execution, and consider removing or re-pointing the .fadein file association on systems that do not require it, which prevents accidental double-click execution of malicious files at the cost of user convenience. Because exploitation requires user interaction and runs only with the privileges of the logged-in user, ensuring day-to-day accounts are non-administrative meaningfully limits the blast radius.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Fade In is a professional screenwriting and document-formatting application, and its native .fadein project files are structured as XML documents that the application parses on load. The flaw is a CWE-787 out-of-bounds write: when the XML parser processes crafted element, attribute, or text content in a malicious .fadein file, it fails to validate the size or destination of a write relative to its allocated buffer, allowing data to be written past the end of that buffer. This is a classic memory-corruption primitive that can be leveraged to corrupt adjacent heap or stack structures and, depending on allocator behavior and platform mitigations, potentially redirect execution flow. The CPE entry cpe:2.3:a:generalcoffee:fade_in:4.2.0 confirms that only version 4.2.0 is identified as affected in the source data, and the root cause sits in the input-handling layer of the file parser rather than in any network-facing service - there is no remote, unauthenticated attack surface component, which is why the assessed vector is local with a required user-interaction precondition.
Know when Fade In gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is opened locally (AV:L) with no attacker privileges (PR:N) but mandatory victim interaction (UI:R); out-of-bounds write yields full code execution, so C/I/A all High.
Primary rating from Vendor (cisco).
CVSS VectorVendor: cisco
DescriptionCVE.org
An out-of-bounds write vulnerability exists in the XML parser functionality of GCC Productions Inc. Fade In 4.2.0. A specially crafted .fadein file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability.
Executive ViewAI
GCC Productions' Fade In 4.2.0, a screenwriting and production tool used by writers, editors, and creative staff, contains an out-of-bounds write in its XML parsing component that a booby-trapped .fadein project file can trigger. Exploitation depends entirely on an employee being persuaded to open an attacker-supplied file, and any resulting code execution is limited to that user's own privileges, making this a targeted social-engineering risk rather than a broad, remotely exploitable threat. With no vendor patch available and publicly available exploit code in circulation, leadership should prioritize user-facing controls and file-handling hygiene over emergency remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: block .fadein files and archives at email/web gateways (publicly available exploit code exists, so delivery is straightforward), open untrusted project files only in a sandboxed or isolated VM, run Fade In as a standard non-privileged user, apply application allowlisting with EDR monitoring for process behavior from Fade In, and train creative staff to reject unsolicited project files.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
GitHub PoC
Exploit-DB