CVE-2024-47412: Adobe Animate Use After Free Vulnerability

CVE-2024-47412 Overview

CVE-2024-47412 is a Use After Free vulnerability [CWE-416] in Adobe Animate versions 23.0.7, 24.0.4, and earlier. The flaw allows an attacker to execute arbitrary code in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file crafted by the attacker. Adobe published the vulnerability in security advisory APSB24-76. The issue affects Animate installations on both Microsoft Windows and Apple macOS.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the user running Adobe Animate, enabling attackers to install programs, alter data, or create new accounts.

Affected Products

Adobe Animate 23.0.7 and earlier
Adobe Animate 24.0.4 and earlier
Microsoft Windows and Apple macOS installations of Animate

Discovery Timeline

2024-10-09 - CVE-2024-47412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47412

Vulnerability Analysis

CVE-2024-47412 is a Use After Free defect in Adobe Animate's file parsing logic. Animate references memory after it has been freed, allowing an attacker to control the freed allocation. When Animate reuses the dangling pointer, the attacker-controlled data drives program flow. This behavior leads to arbitrary code execution in the current user's security context. The attack vector is local and requires the victim to open a malicious Animate project file.

Root Cause

The root cause is improper lifetime management of a heap object during Animate's processing of a crafted file. An object is released while a reference to it remains reachable. Subsequent operations dereference the stale pointer and interact with attacker-supplied content that has replaced the freed region. Use After Free issues in complex parsers like Animate typically arise from asynchronous callbacks, reentrant script hooks, or object caches that outlive their backing allocations.

Attack Vector

An attacker distributes a malicious Animate project or asset file through phishing, drive-by download, or a shared repository. When the victim opens the file in a vulnerable version of Animate, the parser triggers the Use After Free condition. Code execution occurs with the privileges of the logged-on user. No network access, elevated privileges, or authentication are required beyond convincing the user to open the file.

No public proof-of-concept exploit is available for CVE-2024-47412. See the Adobe Security Advisory APSB24-76 for vendor technical details.

Detection Methods for CVE-2024-47412

Indicators of Compromise

Adobe Animate (Animate.exe on Windows, Adobe Animate.app on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters.
Animate process crashes or unusual memory access violations logged around the time a .fla, .xfl, or related project file is opened.
Inbound Animate project files from untrusted email attachments, external sharing services, or unknown collaborators.

Detection Strategies

Monitor process lineage where Animate becomes a parent of scripting, shell, or LOLBin processes.
Alert on Animate writing executable files (.exe, .dll, .scr, .dylib) or scheduled task artifacts to disk.
Correlate file-open events on Animate project extensions with subsequent network connections to unfamiliar destinations.

Monitoring Recommendations

Enable endpoint telemetry for module loads and memory anomalies within Adobe Animate processes.
Track version inventory of Adobe Animate installs to flag hosts still running 23.0.7, 24.0.4, or earlier builds.
Retain and review Windows Event ID 4688 and macOS Endpoint Security process events for Animate-parented executions.

How to Mitigate CVE-2024-47412

Immediate Actions Required

Upgrade Adobe Animate to the fixed versions listed in Adobe Security Advisory APSB24-76.
Inventory endpoints for vulnerable Animate builds and prioritize patching for users who routinely open external project files.
Instruct users to reject Animate files from untrusted sources and to validate authenticity before opening.

Patch Information

Adobe released patched builds of Animate 2023 and Animate 2024 as documented in advisory APSB24-76. Apply the vendor updates through the Adobe Creative Cloud desktop application or an enterprise deployment tool. Confirm the installed version exceeds 23.0.7 and 24.0.4 after patching.

Workarounds

Restrict opening of Adobe Animate project files to those received from verified internal sources until patches are applied.
Run Adobe Animate under a standard user account rather than an administrator to limit the impact of successful exploitation.
Use email and web gateways to block or quarantine Animate project file extensions from external senders.

bash

# Check installed Adobe Animate version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Adobe Animate*" } |
  Select-Object DisplayName, DisplayVersion