Adobe Animate vulnerabilities

109 CVEs affecting Adobe Animate, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76191, published 2026-09-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-7866, published 2016-12-15. Critical severity, CVSS 9.8. EPSS: 15.8% chance of exploitation in the next 30 days. Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
CVE-2021-21077, published 2021-03-12. High severity, CVSS 7.8. EPSS: 8.3% chance of exploitation in the next 30 days. Adobe Animate version 21.0.3 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution…
CVE-2021-28629, published 2021-08-24. High severity, CVSS 7.8. EPSS: 7.8% chance of exploitation in the next 30 days. Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution…
CVE-2021-28620, published 2021-08-24. High severity, CVSS 7.8. EPSS: 7.8% chance of exploitation in the next 30 days. Adobe Animate version 21.0.6 (and earlier) is affected by a Heap-based Buffer Overflow vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution…
CVE-2020-9748, published 2020-10-21. High severity, CVSS 7.8. EPSS: 6.3% chance of exploitation in the next 30 days. Adobe Animate version 20.5 (and earlier) is affected by a stack overflow vulnerability, which could lead to arbitrary code execution in the context of the current user. Exploitation requires user…
CVE-2021-21071, published 2021-03-12. High severity, CVSS 7.8. EPSS: 4.6% chance of exploitation in the next 30 days. Adobe Animate version 21.0.3 (and earlier) is affected by a Memory Corruption vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the…
CVE-2020-9750, published 2020-10-21. High severity, CVSS 7.8. EPSS: 4.5% chance of exploitation in the next 30 days. Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability, which could result in arbitrary code execution in the context of the current user. Exploitation requires…
CVE-2021-28621, published 2021-08-24. High severity, CVSS 7.8. EPSS: 4.3% chance of exploitation in the next 30 days. Adobe Animate version 21.0.6 (and earlier) is affected by an Out-of-bounds Read vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the…
CVE-2020-9749, published 2020-10-21. High severity, CVSS 7.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Animate version 20.5 (and earlier) is affected by an out-of-bounds read vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires…
CVE-2020-9747, published 2020-10-21. High severity, CVSS 7.8. EPSS: 4.1% chance of exploitation in the next 30 days. Adobe Animate version 20.5 (and earlier) is affected by a double free vulnerability when parsing a crafted .fla file, which could result in arbitrary code execution in the context of the current…

Latest

CVE-2026-76191, published 2026-09-08. High severity, CVSS 8.2. EPSS: 0.2% chance of exploitation in the next 30 days. Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged…
CVE-2026-48350, published 2026-07-14. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current…
CVE-2026-48349, published 2026-07-14. High severity, CVSS 8.1. EPSS: 0.2% chance of exploitation in the next 30 days. Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's…
CVE-2026-48348, published 2026-07-14. High severity, CVSS 7.7. EPSS: 0.2% chance of exploitation in the next 30 days. Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's…
CVE-2026-48347, published 2026-07-14. High severity, CVSS 7.7. EPSS: 0.7% chance of exploitation in the next 30 days. Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the…
CVE-2026-48346, published 2026-07-14. High severity, CVSS 7.9. EPSS: 0.3% chance of exploitation in the next 30 days. Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
CVE-2026-48345, published 2026-07-14. High severity, CVSS 8.2. EPSS: 0.9% chance of exploitation in the next 30 days. Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the…
CVE-2025-61804, published 2025-10-15. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Animate versions 23.0.13, 24.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
CVE-2025-54279, published 2025-10-15. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Animate versions 23.0.13, 24.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this…
CVE-2025-54270, published 2025-10-15. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Animate versions 23.0.13, 24.0.10 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose…