CVE-2026-48345 describes an improper neutralization of special elements used in an OS command within Adobe Animate 2023. This vulnerability enables an attacker to execute arbitrary operating system commands in the context of the current user. Successful exploitation requires that a victim opens a crafted malicious file, which triggers the injection. The vulnerability changes the security scope, indicating a broader impact on the application environment. No patch or official remediation has been disclosed at this time.

An attacker who successfully exploits this vulnerability can execute arbitrary code with the privileges of the current user, potentially leading to full system compromise including confidentiality, integrity, and availability impacts. User interaction is required, limiting exploitation to scenarios where a victim opens a malicious file. The vulnerability affects the security scope, which may increase the impact beyond the local application context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to prevent exploitation.