Adobe Illustrator CVE-2026-34662

Exploitation requires that a victim actively open a malicious file using an affected version of Adobe Illustrator (29.8.6 or 30.3 and earlier). The CVSS UI:R metric confirms user interaction is mandatory - there is no network-reachable attack surface and no mechanism for drive-by or automated exploitation. The AV:L metric indicates the attack is bound to the local system context where the file is opened. The flaw is not triggered by any specific non-default configuration; it manifests during ordinary file-open operations. Limiting factors include: (1) the attacker must successfully deliver the malicious file to the victim, typically via social engineering; (2) the victim must explicitly open it in Illustrator; (3) impact is strictly denial-of-service - no code execution, privilege escalation, or data exfiltration is achievable through this vulnerability. SSVC confirms the attack is not automatable, meaning mass exploitation campaigns are not viable.

The aggregate risk signal is low-to-moderate and well-aligned across sources. The CVSS 3.1 score of 5.5 (Medium) reflects the constrained attack surface: AV:L requires the victim's local session, UI:R mandates active user participation, and impact is limited strictly to availability (A:H, C:N, I:N). EPSS of 0.01% at the 3rd percentile confirms that exploitation is extremely unlikely based on observed threat intelligence patterns. The SSVC framework reinforces this: exploitation status is none, the attack is not automatable (it requires social engineering or physical file delivery to each target), and technical impact is only partial. There is no KEV listing and no public POC. The only scenario where this elevates in priority is in environments where creative professionals routinely receive untrusted Illustrator files from external parties, as repeated crash-induction could disrupt workflows. The DoS-only impact (no code execution) significantly limits attacker utility and incident severity.

An attacker crafts a malformed Adobe Illustrator file and delivers it to a target user via email attachment, file-sharing platform, or a compromised collaboration repository. When the victim opens the file in an affected version of Illustrator, the application's file parser dereferences a NULL pointer, causing the process to crash and Illustrator to terminate unexpectedly. No public POC exists; the attack result is limited to application disruption with no persistence or data compromise.