CVE-2021-42268: adobe animate NULL Pointer Dereference
Vulnerability summary
CVE-2021-42268 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in adobe animate. EPSS estimates a 1.79% chance of exploitation in the next 30 days, higher than 78% of scored vulnerabilities.
Timeline
- 18-11-2021PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST5.5MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.79%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.79% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Adobe1 product
- animate≥ unspecified, ≤ 21.0.9 | ≥ unspecified, ≤ None | ≤ 21.0.9
1 vendor · 1 product