Adobe Animate CVE-2025-54279

Exploitation requires the victim to open an attacker-supplied malicious Animate file in a vulnerable build (versions 23.0.13, 24.0.10 and earlier); there is no network-reachable attack surface. Limiting factors that reduce real-world risk: the attack vector is local (AV:L) and demands user interaction (UI:R), so success depends on social engineering to deliver and get the file opened, the attacker cannot trigger it remotely or without a user action, and code execution is confined to the privileges of the current user (S:U, not SYSTEM/root). No special product configuration or feature toggle is needed - the condition is simply that untrusted files are opened in the affected authoring application.

This is a locally-exploited, user-interaction-dependent code execution flaw whose signals are internally consistent and point to moderate, opportunistic risk rather than mass exploitation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes the classic client-side file-open pattern: the 'local' attack vector combined with required user interaction means the attacker cannot reach the vulnerability over the network - a victim must be convinced to open a malicious Animate project/asset file. EPSS reinforces low near-term exploitation likelihood at 0.25% (15th percentile). The CVE is NOT on CISA KEV, and no public proof-of-concept is referenced, so per the available data there is no public exploit identified at time of analysis and no confirmed active exploitation. No SSVC decision record is provided in the input, so exploitation status, automatability, and technical-impact ratings cannot be sourced - this should be noted rather than inferred. The signals do not conflict: high CVSS severity is driven by the full C/I/A impact of arbitrary code execution, while the low EPSS and absence of KEV/POC correctly reflect that attack-vector-local + user-interaction-required bugs are not wormable and depend on social engineering. Net: a genuine high-severity bug worth patching on a normal cycle, but not an emergency unless Animate is used to open untrusted files.

An attacker crafts a malicious Animate document (e.g., a .fla/.xfl project or embedded asset) and delivers it via email, a shared project, or a download masquerading as legitimate work. When the victim opens the file in a vulnerable Animate build (23.0.13, 24.0.10, or earlier), a use-after-free is triggered during parsing, allowing arbitrary code execution in the context of the current user. No public exploit code is referenced, so exploitation would currently require the attacker to develop a working trigger for the freed-object reuse.