EUVD-2026-44438
GHSA-668q-r655-w2wj
Severity by source
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Local file-processing vector (AV:L) with a precondition the attacker cannot control (AC:H); code runs in current-user context so I assess S:U rather than the vendor's S:C, with full C/I/A.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that lets code run in the context of the current user. Adobe reported the flaw via advisory APSB26-83 with a CVSS 8.1 rating; exploitation requires no user interaction but depends on conditions outside the attacker's control (reflected in high attack complexity). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the vulnerable Animate 2023 or 2024 process (AV:L) - in practice, a crafted file or input processed by the application on the victim's machine. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals are moderate rather than emergency-level. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious Adobe Animate project or asset file and delivers it to a victim through a shared project, download, or collaboration channel; when it is processed by a vulnerable Animate 2023/2024 installation, the incorrect authorization flaw is triggered and arbitrary code executes with the current user's privileges. Because exploitation depends on conditions beyond the attacker's control (AC:H) and no POC is known, reliable weaponization is non-trivial. … |
| Remediation | Patch available per vendor advisory: apply the updates described in Adobe bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html) for both Animate 2023 and 2024 as soon as the update cycle permits; the exact fixed build number is not present in the provided data, so pull the precise version from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct comprehensive asset inventory of all systems running Adobe Animate 2023 or 2024 and restrict access to documented business-critical workflows only, enforcing least-privilege user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim ope
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the curr
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today