Adobe Animate CVE-2025-61804

Exploitation requires a user of Adobe Animate (version 23.0.13, 24.0.10, or earlier) to open a maliciously crafted file; this is the explicit limiting condition (UI:R, AV:L). It is NOT remotely triggerable without interaction and does not require the attacker to have any prior privileges or authentication (PR:N) on the target. Code executes only in the context of the current user, so impact is bounded by that user's privileges rather than granting system-level access directly. The primary defender-relevant limiter is the social-engineering step: no exploitation occurs unless the victim is induced to open attacker-supplied content in Animate.

This is a moderate-priority client-side vulnerability rather than an urgent crisis. The CVSS 3.1 base score of 7.8 is driven by high impact (C:H/I:H/A:H) and a local attack vector with low complexity and no privileges, but it is gated by required user interaction (UI:R) - a victim must open a malicious file. All exploitation signals point AWAY from mass exploitation: EPSS is only 0.27% (17th percentile), the CVE is NOT in CISA KEV, and no public exploit code was identified in the provided data. The signals are internally consistent - a low EPSS aligns with the absence of KEV and POC, and the AV:L vector matches the file-open exploitation model described. There is no SSVC decision record in the input to assess automatability or exploitation status independently. Net assessment: patch within a normal cycle, prioritizing systems where untrusted .fla/animation files are opened; this is a genuine arbitrary-code-execution bug but shows no evidence of being a widespread or actively exploited threat at time of analysis.

An attacker crafts a malicious Animate project or asset file with a corrupted structure that triggers a heap-based buffer overflow when parsed. The attacker delivers it via email, a shared project, or a download, and social-engineers an Animate user into opening it, achieving arbitrary code execution in the context of that user. No public exploit code has been identified, and successful exploitation depends entirely on the victim opening the file.