CVE-2022-38412: 
NixOS vulnerability analysis and mitigation

Adobe Animate versions 21.0.11 (and earlier) and 22.0.7 (and earlier) are affected by an out-of-bounds read vulnerability (CVE-2022-38412) when parsing SVG files. The vulnerability was discovered by Mat Powell of Trend Micro Zero Day Initiative and was publicly disclosed on September 19, 2022 (ZDI Advisory, NVD).

The vulnerability is classified as an out-of-bounds read (CWE-125) that occurs during the parsing of SVG files. When processing crafted data in an SVG file, the application can trigger a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The vulnerability could result in a read past the end of an allocated memory structure, potentially leading to code execution (NVD).

Adobe has issued an update to correct this vulnerability. Users should update to the latest version of Adobe Animate that addresses this security issue (Adobe Advisory).