CVE-2026-76191
What it is
Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
At a glance
- Exploitability
- Can be exploited locally on the machine with a low-privilege account, but needs a user to act. High risk of data exposure, data tampering, service disruption.
- Exploit odds
- 0.2% chance of exploitation in the next 30 days (EPSS).
- Fix
- A patch, advisory or fixed version is referenced. Upgrade or apply it.
Timeline
- PublishedDisclosed publicly on CVE.org and NVD
- Last updatedMost recent change to the record
Details
- Published
- Last modified
- Exploit probability
- 0.2% · EPSS, next 30 days
- Weakness
- CWE-94 · Code injection
- Record status
- Analyzed
Affected
- Adobe Animate < 23.0.17
- Adobe Animate < 24.0.14
Attack profile CVSS 3.1 · 8.2
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
