EUVD-2026-44441
GHSA-9pm8-37fw-r2f6
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Local file-open attack needing no prior privileges (PR:N, UI:R, AV:L); untrusted-library load yields full code execution as the user (C/I/A:H), scope unchanged since code runs in the same user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a malicious file, when opened by a victim, load attacker-controlled code in the context of the current user. The issue was reported by Adobe (advisory APSB26-83), requires user interaction, and carries a CVSS 3.1 base score of 7.9 with a changed scope. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Adobe Animate is a desktop authoring application for interactive animation and multimedia (formerly Flash Professional). The root cause is an untrusted search path weakness (CWE-426), the class behind DLL/library-hijacking bugs: when the application resolves a dependent library or helper module, it searches directories that an attacker can influence - commonly the directory from which a document is opened - before or instead of trusted system locations. If a malicious library is planted alongside a crafted project/asset file, Animate loads it and executes its code with the privileges of the user running the application. The affected products per Adobe's CPE data are Adobe Animate 2023 (cpe:2.3:a:adobe:adobe_animate_2023) and Adobe Animate 2024 (cpe:2.3:a:adobe:adobe_animate_2024).
RemediationAI
Apply the Adobe-provided update for Animate 2023 and 2024 as described in advisory APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html); the exact patched version string is published there and was not included in this intelligence set, so pull it from the advisory rather than assuming a build number. Until patched, reduce exposure by treating Animate project and asset files from untrusted sources as dangerous: do not open Animate files delivered by email, downloads, or shared/removable media, and open only files from known directories rather than from the folder where an untrusted archive was extracted, since an untrusted-search-path bug relies on a malicious library sitting beside the opened file. Where feasible, run Animate as a non-administrative user to limit the blast radius of code execution and use application allow-listing to block unexpected DLLs loading from user-writable directories - with the trade-off that overly strict allow-listing can break legitimate plugins or extensions.
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim ope
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that le
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the curr
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today