CVE-2016-7866 Memory corruption in Adobe Animate 15.2.1.95 and earlier
Attackers can execute arbitrary code via memory corruption in Adobe Animate, requiring users to apply vendor patches.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-7866?
CVE-2016-7866 is a critical memory corruption vulnerability in Adobe Animate, published on 15 Dec 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Weakness: CWE-119
Which versions are affected by CVE-2016-7866?
It affects 1 product.
Products include Adobe Animate.
How do I fix CVE-2016-7866?
No fix has been published for CVE-2016-7866 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2016-7866 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-7866 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Adobe Animate
- CVE-2026-48350 Animate | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
- CVE-2026-76191 Animate | Improper Control of Generation of Code ('Code Injection') (CWE-94)
- CVE-2026-48345 Animate | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)
- CVE-2026-48349 Animate | Incorrect Authorization (CWE-863)
- CVE-2026-48346 Animate | Untrusted Search Path (CWE-426)
Sources
Also known as GHSA-qrj4-68mq-fwp3.