Adobe Illustrator CVE-2025-54283

Exploitation requires the victim to open a maliciously crafted file in Adobe Illustrator (version 29.7, 28.7.9, or earlier) - this is the exact trigger stated in the description and reflected by UI:R and AV:L in the CVSS vector. There is no remote or unauthenticated network path; the attacker depends entirely on social engineering to get the file opened. Limiting factors: mandatory user interaction, local (file-based) vector only, no privilege escalation beyond the current user's context (S:U), and the user must be running a vulnerable, unpatched Illustrator version. No special non-default product configuration is required - any default installation parsing the malicious file is exposed.

Signals point consistently to a moderate, not urgent, priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring victim interaction (opening a malicious file) rather than remote network exploitation - despite the 'RCE' tag, this is file-format parsing code execution, not a network-triggerable flaw. EPSS is low at 0.21% (11th percentile), indicating a low modeled probability of exploitation in the near term. The vulnerability is NOT listed in CISA KEV and no public exploit code is identified in the provided data, so there is no evidence of active exploitation. The high confidentiality/integrity/availability impact is real (arbitrary code execution as the current user), but the mandatory user-interaction requirement and absence of exploitation signals place this below internet-facing, auto-exploitable issues. No conflicting signals are present: the CVSS local vector is consistent with the description's 'open a malicious file' requirement. Prioritize via normal patch cycles for workstations running Illustrator, with elevated attention for users who routinely open untrusted .ai/design files.

An attacker crafts a malicious Illustrator-compatible file and delivers it via email, a shared drive, or a download, socially engineering a designer into opening it. When Illustrator parses the malformed file, an out-of-bounds write corrupts memory and executes attacker-controlled code in the context of the current user. No public proof-of-concept is identified at time of analysis, and the local attack vector means the attacker cannot trigger this remotely without the victim opening the file.