Adobe Connect and Adobe Connect Desktop Application contain a flaw that deserializes untrusted data, a classic CWE-502 vulnerability. The flaw allows an attacker to execute code within the context of the user who triggers the deserialization, and the scope change means the attacker may affect higher-level components or system‑wide resources beyond the single user. The attack requires the victim to follow a maliciously crafted link or interact with a compromised webpage so that the application processes the attacker’s payload.

Adobe Connect and Adobe Connect Desktop Application on macOS and Windows. The vulnerability affects releases 2025.3, 12.10 and all earlier versions.

The CVSS score of 9.6 identifies the issue as critical, and the EPSS score of 2% indicates a modest but non-zero likelihood of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Based on the description, the attack vector is remote but requires user interaction through a malicious URL or webpage; the changed scope elevates the potential damage if exploitation succeeds.