CVE-2024-45155 Overview
CVE-2024-45155 is an Access of Uninitialized Pointer vulnerability [CWE-824] affecting Adobe Animate versions 23.0.8, 24.0.5, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Exploitation requires user interaction, which limits mass exploitation but remains viable in targeted phishing scenarios. Adobe published fixes in security advisory APSB24-96 on December 10, 2024.
Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the logged-in user, potentially leading to full account compromise on Windows and macOS workstations.
Affected Products
- Adobe Animate 23.0.8 and earlier
- Adobe Animate 24.0.5 and earlier
- Apple macOS and Microsoft Windows host platforms
Discovery Timeline
- 2024-12-10 - Adobe releases security patch (APSB24-96)
- 2024-12-10 - CVE-2024-45155 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-45155
Vulnerability Analysis
The vulnerability is classified under [CWE-824]: Access of Uninitialized Pointer. Adobe Animate reads a pointer value from memory that was never properly initialized before use. When the application dereferences that pointer during file parsing, the target address is either attacker-influenced or contains stale data from prior allocations.
An attacker who controls the surrounding memory layout can steer the uninitialized pointer to a chosen location. This transforms a memory safety bug into a code execution primitive. The vulnerable code path is reached during processing of a crafted Animate project or asset file.
Root Cause
The root cause is missing initialization of a pointer field inside a file-parsing structure. Adobe Animate allocates the containing object but does not zero or assign the pointer before a downstream function reads it. Under specific crafted inputs, the parser follows the uninitialized value, resulting in an unsafe read or write.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a malicious Animate file through email, chat, or a compromised website. When the victim opens the file in a vulnerable version of Animate, the parser triggers the uninitialized pointer access. Code then executes with the privileges of the current user, allowing credential theft, persistence, or lateral movement.
No verified public proof-of-concept exploit is available. Refer to the Adobe Security Advisory APSB24-96 for vendor-provided technical context.
Detection Methods for CVE-2024-45155
Indicators of Compromise
- Unexpected child processes spawned by Animate.exe on Windows or the Animate binary on macOS, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
- Animate process crashes or exceptions logged around the time users open third-party .fla, .xfl, or related asset files.
- Outbound network connections initiated by the Animate process to non-Adobe infrastructure.
Detection Strategies
- Hunt for process lineage anomalies where Animate is the parent of scripting engines, LOLBins, or file-writing utilities.
- Monitor endpoint telemetry for module loads or DLL side-loading events inside the Animate installation directory.
- Correlate email and web gateway logs with endpoint file-open events to identify inbound delivery of suspicious Animate project files.
Monitoring Recommendations
- Enable command-line and process creation auditing on workstations running Adobe Animate.
- Track version inventory of Animate installs and alert on hosts still running 23.0.8 or 24.0.5 and earlier.
- Capture crash dump events for the Animate process to identify exploitation attempts that fail before achieving execution.
How to Mitigate CVE-2024-45155
Immediate Actions Required
- Upgrade Adobe Animate to the versions listed in APSB24-96 on all Windows and macOS endpoints.
- Instruct users not to open Animate project files received from untrusted sources until patching is complete.
- Validate patch deployment through software inventory tooling and remove unsupported Animate installs.
Patch Information
Adobe addressed CVE-2024-45155 in security advisory APSB24-96, published December 10, 2024. Upgrade Adobe Animate 2023 to version 23.0.9 or later, and Adobe Animate 2024 to version 24.0.6 or later. Consult the Adobe Security Advisory APSB24-96 for exact fixed version numbers and download locations.
Workarounds
- Block inbound .fla, .xfl, and related Animate file types at email and web gateways where they are not required for business use.
- Run Adobe Animate under a standard user account to limit the blast radius of successful exploitation.
- Apply application allowlisting to prevent Animate from spawning scripting interpreters or unsigned binaries.
# Example: block child process creation from Animate via WDAC or AppLocker policy references
# Review Microsoft documentation for AppLocker rule authoring on the Animate.exe binary
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
