Adobe Illustrator CVE-2026-34687

Exploitation requires the victim to open an attacker-supplied malicious file in Adobe Illustrator (CVSS UI:R), and the local attack vector (AV:L) means the crafted file must be delivered to and processed on the target's machine rather than exploited remotely over a network. The affected build must be Illustrator 29.8.6/30.3 or earlier. Limiting factors: mandatory user interaction (opening the file), execution confined to the current user's privileges (S:U, no privilege escalation), and no authentication needed by the attacker to craft the file (PR:N) but no automated or unattended trigger - this is not exploitable against a default configuration without a user opening content.

Signals are internally consistent and point to a genuine but not urgent-in-the-wild risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 High) reflects local attack vector requiring user interaction (opening a file) with full CIA impact - high technical impact but a meaningful barrier via social engineering. This aligns with SSVC: Technical Impact 'total', Automatable 'no', Exploitation 'none'. EPSS is very low (0.03%, 7th percentile) and there is no KEV listing and no known POC, so this is a legitimate code-execution bug worth patching in normal cycles rather than an emergency. No conflicting data was identified; the main limiting factor is the required user interaction, which caps mass-exploitation potential.

An attacker crafts a malicious Illustrator document with corrupted heap structures and delivers it via email, a shared design asset, or a download, luring a designer to open it. When Illustrator parses the file, the heap overflow triggers and arbitrary code executes in the context of the logged-in user. No public exploit code is known at time of analysis, and success requires the victim to open the file (UI:R).