EUVD-2026-44560
GHSA-54c9-vvfv-c6vf
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Local vector because the victim must open a crafted file (AV:L, UI:R); no prior privileges needed (PR:N); untrusted-search-path code execution yields total C/I/A with a scope change (S:C).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Illustrator Desktop (2026 versions ≤30.5 and 2025 versions ≤29.8.7) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file that abuses an untrusted search path (CWE-426). The flaw carries a CVSS 3.1 score of 8.6 with a changed scope, but exploitation is local and requires user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and CISA SSVC rates exploitation as none.
Technical ContextAI
The vulnerability is an Untrusted Search Path issue (CWE-426), a classic binary/DLL/resource-planting weakness in which the application resolves and loads a dependency (such as a library or helper module) from an attacker-influenced location rather than a trusted, fully-qualified path. In practice for Illustrator on the desktop, a malicious payload placed alongside a crafted document or in a directory that appears earlier in the search order is loaded and executed when the victim opens the file. The affected component is the Adobe Illustrator desktop application (CPE cpe:2.3:a:adobe:illustrator:*), a native Windows/macOS creative-suite product; the CWE root cause means the fix typically involves hardening how the application locates and validates the libraries or components it loads.
RemediationAI
Vendor-released patch: upgrade Adobe Illustrator 2026 to version 30.6 and Illustrator 2025 to version 29.8.9, per Adobe security bulletin APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); these are the exact fixed builds listed in the EUVD data. Because exploitation requires a victim to open a malicious file, the most effective compensating control until patching is user-side: do not open Illustrator files (.ai and associated assets) received from untrusted or unverified sources, and quarantine incoming design files from email or the web before opening - the trade-off is reduced collaboration convenience. Restricting write access to directories that Illustrator searches for loadable components (so attackers cannot plant a rogue library next to opened files) and application allow-listing of native modules can further reduce the untrusted-search-path risk, at the cost of tighter endpoint configuration management.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-426 – Untrusted Search Path
View allShare
External POC / Exploit Code
Leaving vuln.today