EUVD-2026-44440
GHSA-3354-3vp3-3wjg
Severity by source
AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Local file-open attack needing no attacker privileges (PR:N) but victim interaction (UI:R); code runs as the current user with full CIA impact, contained to that user context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run commands in the context of the current user via an OS command injection flaw (CWE-78) triggered when a victim opens a maliciously crafted file. The scope-changed CVSS 3.1 score of 8.2 reflects that successful exploitation can affect resources beyond the vulnerable application. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the primary risk gate is social-engineering the victim into opening a hostile document.
Technical ContextAI
Adobe Animate is a desktop authoring application for interactive animation and multimedia content (the successor to Flash Professional), and the affected builds are the 2023 and 2024 release lines identified by cpe:2.3:a:adobe:adobe_animate_2023 and cpe:2.3:a:adobe:adobe_animate_2024. The root cause is CWE-78, Improper Neutralization of Special Elements used in an OS Command, meaning that untrusted data - most plausibly embedded in or referenced by a crafted project/asset file parsed by Animate - reaches an operating-system command interpreter without adequate sanitization, letting attacker-controlled special characters break out into shell command context. Because the CVSS scope is marked changed (S:C), the injected command executes with an authority or reach that extends beyond the security scope of the parsing application itself.
RemediationAI
Apply the vendor update referenced in Adobe security bulletin APSB26-83 (https://helpx.adobe.com/security/products/animate/apsb26-83.html) - Patch available per vendor advisory, though the exact fixed version was not included in the provided data and must be read from APSB26-83. Because exploitation requires a user to open a malicious file, the strongest compensating control until patching is to avoid opening Animate project or asset files from untrusted or unsolicited sources and to handle any such files only in an isolated/sandboxed VM (trade-off: disrupts collaboration workflows that legitimately exchange project files). Enforce least privilege on workstations running Animate so that any command execution inherits minimal rights, and use application allow-listing / EDR to flag Animate spawning shell or command-interpreter child processes (trade-off: may generate false positives from legitimate scripting/extension features).
More in Adobe Animate 2023
View allArbitrary code execution in Adobe Animate 2023 and 2024 stems from a path traversal weakness triggered when a victim ope
Arbitrary code execution in Adobe Animate 2023 and 2024 stems from an incorrect authorization (CWE-863) weakness that le
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an untrusted search path (CWE-426) flaw that lets a
Arbitrary code execution in Adobe Animate 2023 and 2024 allows an attacker to run OS commands in the context of the curr
Arbitrary code execution in Adobe Animate 2023 and 2024 arises from an Incorrect Authorization flaw (CWE-863) that lets
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today