CVE-2024-20761: 
NixOS vulnerability analysis and mitigation

CVE-2024-20761 is an out-of-bounds write vulnerability affecting Adobe Animate versions 24.0, 23.0.3 and earlier. The vulnerability was discovered by Francis Provencher (prl) and disclosed in March 2024. This security flaw affects Adobe Animate installations on both Windows and macOS operating systems (NVD).

The vulnerability is classified as an out-of-bounds write (CWE-787) with a CVSS v3.1 base score of 7.8 (HIGH). The attack vector is local (AV:L) with low attack complexity (AC:L), requiring no privileges (PR:N) but needs user interaction (UI:R). The scope is unchanged (S:U) with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (NVD).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. The impact could be significant, particularly for users with administrative privileges, potentially allowing an attacker to install programs, view, change, or delete data, or create new accounts with full user rights (CIS Advisory).

Exploitation of this vulnerability requires user interaction, specifically requiring a victim to open a malicious file. Currently, there are no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update their Adobe Animate installations to versions newer than 23.0.3 for the 2023 release or newer than version 24.0 for the 2024 release (Adobe Advisory).