EUVD-2026-29617
GHSA-xvcv-5fpw-x4r5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File-open trigger means AV:L and UI:R; attacker needs no privileges; impact is application crash only, so C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator versions 29.8.6, 30.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Adobe Illustrator versions 29.8.6, 30.3 and earlier are vulnerable to a NULL Pointer Dereference (CWE-476) in file parsing that crashes the application, resulting in a denial-of-service condition. Exploitation requires a victim to open a specially crafted malicious file, making this a file-borne, local-vector threat with no code execution capability. No public exploit code exists and EPSS places exploitation probability at 0.01% (3rd percentile), consistent with the SSVC assessment of no active exploitation and non-automatable delivery.
Technical ContextAI
The vulnerability is rooted in CWE-476 (NULL Pointer Dereference), a class of flaw in which the application attempts to dereference a pointer that has not been assigned a valid memory address, typically during the parsing or processing of a crafted input file. Adobe Illustrator's file parser fails to validate a pointer before use when processing a maliciously structured input file, causing the process to crash. The affected CPE is cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*, covering all Illustrator variants up to and including versions 29.8.6 (the 29.x line) and 30.3 (the 30.x line) as confirmed by both NVD CPE data and the EUVD record EUVD-2026-29617. The flaw is scoped to the Illustrator process itself (S:U) with no lateral impact to the underlying OS or other processes.
RemediationAI
The primary fix is to upgrade Adobe Illustrator to a version beyond the affected range per vendor advisory APSB26-51 at https://helpx.adobe.com/security/products/illustrator/apsb26-51.html. An exact patched version number was not independently confirmed from the available input data - consult APSB26-51 directly for the precise upgrade target. As a compensating control where immediate patching is not feasible, organizations should instruct users to avoid opening Illustrator files from untrusted or unsolicited sources, as exploitation is entirely contingent on this single user action. Enforcing file provenance controls (e.g., blocking .ai/.eps/.svg attachments from external email in gateway policies) reduces exposure with minimal workflow disruption. Because the impact is DoS-only with no code execution or data exposure risk, the urgency for emergency patching is low; standard patch cycle timelines are appropriate.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today