CVE-2026-76191: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Adobe Adobe Animate 2023

CVE-2026-76191 is an improper control of generation of code vulnerability in Adobe Animate 2023. This code injection flaw enables a low-privileged attacker to execute arbitrary code with the current user's privileges if the victim opens a specially crafted malicious file. The vulnerability affects versions up to and including 23.0.16 and 24.0.14. The CVSS 3.1 base score is 8.2, reflecting high severity with attack vector local, low attack complexity, low privileges required, user interaction needed, and changed scope. Confidentiality, integrity, and availability impacts are all high.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially allowing an attacker to compromise the affected system's confidentiality, integrity, and availability. However, exploitation requires user interaction (opening a malicious file) and local access with low privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening files from untrusted sources and apply standard security best practices to limit exposure.