EUVD-2026-73591
GHSA-75w7-cqxv-p63r
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
PR:N assessed because delivering a malicious file requires no prior system privileges; all other vendor metrics retained as technically sound.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Code injection in Adobe Animate allows a low-privileged attacker to achieve arbitrary code execution in the context of the current user by convincing a victim to open a specially crafted malicious file. Both the 2023 and 2024 major release lines are affected, covering all versions up to and including 23.0.16 and 24.0.14 respectively. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to actively open a malicious Animate project file using an unpatched version of Adobe Animate 2023 (≤23.0.16) or Animate 2024 (≤24.0.14). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-assigned CVSS score of 8.2 with a vector of AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H reflects high impact but meaningful prerequisites: a local attack vector, user interaction, and low-privilege attacker context. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult Adobe security bulletin APSB26-132 at https://helpx.adobe.com/security/products/animate/apsb26-132.html for the official fixed versions, which should be the first releases after 24.0.14 (Animate 2024) and 23.0.16 (Animate 2023) respectively - exact patched version numbers are not independently confirmed from the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all Animate installations, alert creative teams to avoid opening Animate files from untrusted sources, and escalate to leadership that no patch currently exists. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Rated critical severit
Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitra
Animate versions 24.0.8, 23.0.11 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could
Animate versions 24.0.8, 23.0.11 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could
Animate versions 24.0.8, 23.0.11 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability tha
Animate versions 24.0.8, 23.0.11 and earlier are affected by an out-of-bounds write vulnerability that could result in a
Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resul
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrar
Animate versions 23.0.8, 24.0.5 and earlier are affected by a Buffer Underwrite ('Buffer Underflow') vulnerability that
Animate versions 23.0.8, 24.0.5 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that
Animate versions 23.0.8, 24.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in ar
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today