CVE-2026-48349
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
An Incorrect Authorization vulnerability in Animate could allow arbitrary code execution in the context of the current user. Exploitation does not require user interaction but depends on conditions beyond the attacker's control. The scope of the vulnerability has changed.
Risk Assessment
The risk involves an attacker potentially gaining control over the user's workstation, which could lead to data theft, malware installation, or lateral movement within the internal network.
Recommendation
It is recommended to immediately update Animate to the latest version provided by the vendor. Additionally, restrict user privileges and monitor systems for unusual activity.
Other vulnerabilities in Adobe Animate
See all- CVE-2016-7866Critical
Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
- CVE-2025-54270Medium
A NULL Pointer Dereference vulnerability in Adobe Animate versions 23.0.13, 24.0.10 and earlier could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive memory information. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2025-54269Medium
An out-of-bounds read vulnerability in Adobe Animate versions 23.0.13, 24.0.10 and earlier could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation requires user interaction in that a victim must open a malicious file.
Original NVD description (English source)
Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. Scope is changed.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS