EUVD-2026-22697Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Illustrator 30.2, 29.8.5 and earlier versions allows unauthenticated local attackers to execute malicious code with current user privileges via crafted file exploitation. The vulnerability requires user interaction (opening a malicious file) but has low attack complexity once delivered. No public exploit identified at time of analysis, with EPSS data unavailable for risk quantification. The out-of-bounds write flaw affects memory management during file parsing operations.
Technical ContextAI
This vulnerability stems from an out-of-bounds write condition (CWE-787) in Adobe Illustrator's file parsing engine. Out-of-bounds write vulnerabilities occur when software writes data beyond the allocated memory buffer boundaries, enabling attackers to corrupt adjacent memory regions. In Illustrator's case, the flaw manifests during processing of maliciously crafted input files, allowing write operations beyond intended memory bounds. This memory corruption class is particularly dangerous in graphics applications that parse complex file formats (AI, EPS, PDF, SVG) containing embedded fonts, vectors, raster images, and metadata. The vulnerability affects Illustrator versions 30.2, 29.8.5 and all earlier releases, representing a wide attack surface across the creative professional user base. The CVSS vector indicates local attack vector (AV:L) requiring user interaction (UI:R) but no privileges (PR:N), meaning any user who can be convinced to open a file can trigger exploitation.
RemediationAI
Adobe has released security updates addressing this vulnerability through advisory APSB26-42. Users must immediately upgrade to the patched versions specified in the vendor advisory at https://helpx.adobe.com/security/products/illustrator/apsb26-42.html. The remediation process requires downloading and installing the latest Illustrator release through Adobe Creative Cloud desktop application or direct download from Adobe's official distribution channels. Enterprise administrators should prioritize deployment through managed update systems and verify successful patch application across all endpoints running affected versions. Until patching is complete, organizations should implement compensating controls including user awareness training about malicious file risks, email attachment filtering for Illustrator file formats, and restricting Illustrator file opening to trusted sources only. Disable automatic file preview features and consider application sandboxing technologies to limit exploitation impact. No effective workarounds exist that maintain full Illustrator functionality while mitigating the vulnerability.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a speciall
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today