CVE-2024-30295: Adobe Animate RCE Vulnerability

CVE-2024-30295 Overview

CVE-2024-30295 is a NULL Pointer Dereference vulnerability [CWE-476] affecting Adobe Animate versions 24.0.2, 23.0.5, and earlier. The flaw can result in arbitrary code execution in the context of the current user. Exploitation requires local access and user interaction, as a victim must open a malicious file crafted by an attacker.

The vulnerability affects Adobe Animate installations on both Microsoft Windows and Apple macOS. Adobe published the fix in security advisory APSB24-36. No public exploit or proof-of-concept has been observed, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
A crafted Animate project file can trigger a NULL pointer dereference leading to arbitrary code execution under the current user's privileges on Windows or macOS.

Affected Products

Adobe Animate 24.0.2 and earlier (24.x branch)
Adobe Animate 23.0.5 and earlier (23.x branch)
Microsoft Windows and Apple macOS host platforms

Discovery Timeline

2024-05-16 - CVE-2024-30295 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-30295

Vulnerability Analysis

Adobe Animate parses complex project files that reference numerous internal objects, symbols, and asset structures. A NULL Pointer Dereference occurs when the application dereferences a pointer that was never initialized or was cleared during parsing of an attacker-controlled file. On modern desktop platforms, this condition can move beyond a simple crash when the invalid memory region is influenced by attacker-supplied data.

Because Animate runs with the privileges of the interactive user, successful exploitation grants the attacker the same permissions as the victim. This includes reading user documents, writing to profile locations, and executing follow-on payloads such as script hosts or downloaders.

Root Cause

The root cause is a missing validation check on an object pointer before dereference during file parsing. The application assumes the referenced object exists in memory, but a malformed file produces a code path in which the pointer is NULL or references an unmapped region. The dereference then triggers memory corruption exploitable for code execution.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious Animate project file, then delivers it through email, a shared drive, a collaboration platform, or a compromised website. When the victim opens the file in a vulnerable version of Animate, the parser reaches the flawed code path and control of execution is passed to attacker-controlled data.

Exploitation does not require elevated privileges before opening the file. The impact is bounded by the current user's rights on the host.

Detection Methods for CVE-2024-30295

Indicators of Compromise

Unexpected child processes spawned by Animate.exe (Windows) or Adobe Animate (macOS), including cmd.exe, powershell.exe, wscript.exe, bash, or osascript.
Animate process crashes followed by writes to autorun locations, scheduled tasks, or LaunchAgents.
Inbound .fla, .xfl, or associated Animate project archives arriving from untrusted email senders or external file shares.

Detection Strategies

Alert on Adobe Animate process trees that deviate from normal editing activity, particularly network egress or shell execution originating from the application.
Inspect endpoint logs for access violation or segmentation fault events referencing the Animate executable, which may indicate exploitation attempts.
Correlate file open telemetry for Animate project files against sender reputation and file provenance data.

Monitoring Recommendations

Ingest endpoint process, file, and module-load telemetry into a central data lake for retroactive hunting against the Animate binary.
Track installed Animate versions across the fleet and alert when unpatched builds (24.0.2, 23.0.5, or earlier) execute.
Monitor mail and web gateways for Animate project file types delivered to users who do not routinely work with them.

How to Mitigate CVE-2024-30295

Immediate Actions Required

Upgrade Adobe Animate to the fixed versions listed in Adobe Security Advisory APSB24-36.
Inventory all endpoints running Animate on Windows and macOS and prioritize creative and design workstations.
Instruct users not to open Animate project files received from untrusted or unverified sources until patching completes.

Patch Information

Adobe addressed CVE-2024-30295 in the updates published in Adobe Security Advisory APSB24-36. Administrators should apply the vendor-provided updates for both the 24.x and 23.x branches. No configuration change alone remediates the underlying NULL pointer dereference.

Workarounds

Restrict opening of Animate project files to a curated set of trusted internal sources until patches are deployed.
Run Animate under standard user accounts rather than administrative accounts to limit post-exploitation impact.
Use application allow-listing to block child processes such as shells or script interpreters from launching under the Animate executable.

bash

# Windows: check installed Animate version via registry
reg query "HKLM\SOFTWARE\Adobe\Animate" /s /v Version

# macOS: check installed Animate version
defaults read "/Applications/Adobe Animate 2024/Adobe Animate 2024.app/Contents/Info.plist" CFBundleShortVersionString