EUVD-2026-44563
GHSA-g44r-x3wp-8593
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted Illustrator file via phishing
-
DeliveryVictim opens file in Illustrator
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionCorrupt memory control structures
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a specially crafted malicious file in a vulnerable Illustrator build (Desktop 2025 ≤29.8.7 or 2026 ≤30.5) - this user-interaction step (UI:R) is the primary prerequisite and the main limiting factor. The attacker needs no prior authentication or privileges on the host (PR:N) and needs no special Illustrator configuration; default installations are exploitable once the file is opened. The vector is local (AV:L): the crafted file must be delivered to and opened on the target machine (via email, download, shared drive, or supply-chain asset), so there is no remote, unauthenticated, no-click exploitation path. Code executes only at the privilege level of the user running Illustrator, not elevated. |
| Impact | The signals point to a serious-but-not-emergency issue. CVSS 7.8 (HIGH) reflects total loss of confidentiality, integrity, and availability (C:H/I:H/A:H) but is gated by AV:L (local - the malicious file must reach the host) and UI:R (the victim must open it); PR:N means no attacker privileges are needed once the file is opened. These corroborate each other: high impact, but attacker-independent delivery/user-interaction requirements limit scale. CISA SSVC agrees - Exploitation: none (no observed or public exploitation), Automatable: no (cannot be reliably mass-scripted because it needs a human to open a file), Technical Impact: total. EPSS is low at 0.14% (4th percentile), and there is no KEV listing and no POC referenced, so this is not currently a priority for opportunistic mass exploitation. It matters most for targeted spear-phishing against organizations that routinely open externally-supplied Illustrator/PDF/design files. No conflicting data was observed; the local attack vector is consistent with the 'victim opens a malicious file' description. |
| Exploit ScenarioDerived | An attacker crafts a malicious Illustrator-compatible file (e.g., a booby-trapped .ai or .pdf) that triggers the out-of-bounds write during parsing and emails it to a designer as a 'client brief' or 'logo asset.' When the victim opens the file in an unpatched Illustrator build, memory corruption is leveraged to execute code with the user's privileges. No public POC is currently identified, and the local vector plus required user interaction (AV:L/UI:R) mean success depends on social engineering rather than direct network reach. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.
RemediationAI
Vendor-released patch: update Illustrator Desktop 2025 to version 29.8.9 and Illustrator Desktop 2026 to version 30.6 as published in Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); apply via the Creative Cloud desktop app or enterprise Admin Console. Until patching is complete, treat the vulnerability as file-borne: do not open Illustrator, PDF, SVG, or EPS files received from untrusted or unsolicited sources, and route externally-supplied design assets through a sandboxed or isolated review workstation before opening on production endpoints - the trade-off is added workflow friction and slower handling of legitimate external files. Because exploitation requires the user to open a crafted file, email/gateway filtering and user awareness of unexpected design-file attachments materially reduce risk, but these are compensating controls only and do not remove the underlying flaw, so upgrading remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe Illustrator is a desktop vector-graphics application that parses a wide range of complex file formats (AI, PDF, SVG, EPS, and imported raster/asset data). The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application's file-parsing logic writes past the bounds of an allocated buffer - typically because a length, offset, or index field taken from attacker-controlled file data is trusted without validation. Overwriting adjacent heap or stack memory can corrupt control data (function pointers, vtables, return addresses) and be leveraged for arbitrary code execution. The tags (Buffer Overflow, Memory Corruption, RCE) reinforce this as a classic parser memory-safety defect. CPE data confirms the affected component is cpe:2.3:a:adobe:illustrator across all sub-versions, i.e. the desktop Illustrator application itself rather than a plugin or cloud service.
Know when Illustrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file must be opened by the victim (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE yields full user-context compromise, so C/I/A all High.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Illustrator Desktop (versions 2025 ≤29.8.7 and 2026 ≤30.5) contains a remote code execution vulnerability triggered by opening maliciously crafted files. With no patch available and the attack vector relying on social engineering rather than network automation, design teams face targeted risk requiring immediate file-access controls and user communication.
No vendor-released patch identified at time of analysis. Interim mitigations: user-awareness training on file-origin verification, email attachment scanning and filtering, network segmentation for design workstations, restriction of file-sharing channels to authenticated internal systems, and disabling of auto-open or preview features in Adobe Illustrator.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Exploit-DB