CVE-2020-9748: 
NixOS vulnerability analysis and mitigation

Adobe Animate version 20.5 and earlier versions are affected by a stack overflow vulnerability identified as CVE-2020-9748. The vulnerability was discovered and disclosed in October 2020, affecting the Adobe Animate software on Windows platforms (NVD, Fortinet).

The vulnerability is a memory corruption issue that exists in the decoding of FLA files in Adobe Animate, specifically in the Animate.exe module. It is caused by a malformed FLA file that triggers an Out of Bounds memory access due to an improper bounds check. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, Fortinet).

If successfully exploited, this vulnerability could lead to arbitrary code execution in the context of the current user. The vulnerability has been rated as Critical due to its potential impact on system security (NVD).

Exploitation of this vulnerability requires user interaction, specifically that a victim must open a crafted .fla file in Adobe Animate. The attack complexity is considered low, requiring no privileges but does need user interaction (NVD).

Adobe has released security patches to address this vulnerability. Fortinet has also released an IPS signature named Adobe.Animate.CVE-2020-9748.Memory.Corruption to proactively protect their customers before the patch became available (Fortinet).