CVE-2021-42268

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Adobe Animate version 21.0.9 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted FLA file. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-422697.8Adobe Animate version 21.0.9 (and earlier) are affected by a use-after-free vulnerability in the processing of a malformed FLA file that cou CVE-2021-42275.3The ark-commenteditor WordPress plugin through 2.15.6 does not properly sanitise or encode the comments when in Source editor, allowing atta CVE-2021-422707.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio CVE-2021-422717.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio CVE-2021-422727.8Adobe Animate version 21.0.9 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code executio CVE-2021-422746.8Windows Hyper-V Discrete Device Assignment (DDA) Denial of Service Vulnerability CVE-2021-422758.8Microsoft COM for Windows Remote Code Execution Vulnerability CVE-2021-422767.8Microsoft Windows Media Foundation Remote Code Execution Vulnerability CVE-2021-422775.5Diagnostics Hub Standard Collector Elevation of Privilege Vulnerability CVE-2021-422787.5Active Directory Domain Services Elevation of Privilege Vulnerability CVE-2021-422794.2Chakra Scripting Engine Memory Corruption Vulnerability CVE-2021-42287.4Use of hard-coded TLS certificate by default allows an attacker to perform Man-in-the-Middle (MitM) attacks even in the presence of the HTTP