EUVD-2026-44438
GHSA-668q-r655-w2wj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Local file-processing vector (AV:L) with a precondition the attacker cannot control (AC:H); code runs in current-user context so I assess S:U rather than the vendor's S:C, with full C/I/A.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that lets code run in the context of the current user. Adobe reported the flaw via advisory APSB26-83 with a CVSS 8.1 rating; exploitation requires no user interaction but depends on conditions outside the attacker's control (reflected in high attack complexity). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
Adobe Animate is a multimedia authoring and animation application (successor to Flash Professional) used to create interactive vector graphics, HTML5 Canvas, and rich media content. The root cause is CWE-863 Incorrect Authorization, meaning an authorization check is performed but implemented incorrectly, allowing an action or code path to execute that a proper permission check should have blocked. Per the CPE data the affected builds are cpe:2.3:a:adobe:adobe_animate_2023 and cpe:2.3:a:adobe:adobe_animate_2024. The vendor tags this as an authentication/authorization bypass that culminates in remote code execution within the privileges of the logged-in user, consistent with the class of desktop-application flaws where malformed input or an unexpected code path bypasses intended trust boundaries.
RemediationAI
Patch available per vendor advisory: apply the updates described in Adobe bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html) for both Animate 2023 and 2024 as soon as the update cycle permits; the exact fixed build number is not present in the provided data, so pull the precise version from that advisory. Until patched, reduce exposure by treating Animate project and asset files from untrusted or external sources as suspect and not opening them, since arbitrary code execution runs with the current user's privileges - running Animate under a least-privileged, non-administrative account limits blast radius but does not stop code execution in that user's own context. Given the local attack vector, restricting the delivery of untrusted files (email/download controls, application allow-listing of the files Animate opens) is the most practical compensating control, with the trade-off of workflow friction for legitimate external collaboration.
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim ope
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the curr
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today