EUVD-2026-29621
GHSA-qc2r-fgrp-q967
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user, so AV:L and UI:R; attacker needs no privileges (PR:N) and code runs at user level with full CIA impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Illustrator versions 29.8.6, 30.3 and earlier arises from a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted file, letting an attacker run code with the privileges of the current user. It affects desktop installations of both the 29.x and 30.x release trains and was reported by Adobe PSIRT under advisory APSB26-51. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%, 7th percentile), consistent with CISA SSVC rating exploitation as 'none'.
Technical ContextAI
The flaw is a CWE-122 heap-based buffer overflow in Adobe Illustrator, a widely used vector graphics editor, occurring during parsing/processing of a specially crafted document file. Heap overflows happen when the application writes more data into a heap-allocated buffer than it was sized for - typically due to inadequate bounds checking on attacker-controlled length or index fields inside a malformed file format (e.g., AI/EPS/PDF-derived structures Illustrator ingests). Corrupting adjacent heap metadata or object pointers can be leveraged to hijack control flow and achieve code execution in the user's security context. The CPE data (cpe:2.3:a:adobe:illustrator:*) confirms the affected component is the Illustrator desktop application itself rather than a shared library or service.
RemediationAI
Upgrade Adobe Illustrator to the fixed releases published in Adobe Security Bulletin APSB26-51 (https://helpx.adobe.com/security/products/illustrator/apsb26-51.html), which supersede the vulnerable 29.8.6/30.3-and-earlier builds - the exact patched version numbers should be confirmed directly from that advisory as they are not enumerated in the provided input. Because exploitation depends on opening a malicious file, effective interim compensating controls are to instruct users not to open Illustrator files from untrusted or unsolicited sources, block or quarantine inbound .ai/.eps and related design files at the email/web gateway, and open unknown artwork only in an isolated or sandboxed environment; the trade-off is friction for design teams that routinely exchange files with external partners. Use Adobe's Creative Cloud desktop app to push the update fleet-wide.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today