CVE-2026-48345 is an OS Command Injection vulnerability in Adobe Animate 2023 caused by improper neutralization of special elements used in OS commands. This flaw enables an attacker to execute arbitrary code in the context of the current user if the victim opens a crafted malicious file. The vulnerability requires user interaction and has a changed scope, indicating that the impact extends beyond the initially vulnerable component. The CVSS v3.1 base score is 8.2, reflecting high severity with local attack vector, low attack complexity, low privileges required, user interaction needed, and complete impact on confidentiality, integrity, and availability.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially resulting in full system compromise including confidentiality, integrity, and availability impacts. The attack requires the victim to open a malicious file, which means social engineering or tricking the user is necessary. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch links are provided, users should avoid opening untrusted files in Adobe Animate 2023 and monitor Adobe's security advisories for updates. No vendor-provided mitigation or temporary fix is currently documented.