What is the CVSS score of CVE-2026-48335?

CVE-2026-48335 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Adobe Illustrator are affected by CVE-2026-48335?

Adobe Illustrator Desktop (versions 2025 ≤29.8.7 and 2026 ≤30.5) contains a remote code execution vulnerability triggered by opening maliciously crafted files.

How to fix or mitigate CVE-2026-48335?

Within 24 hours, enumerate all Adobe Illustrator installations across the organization and identify affected versions; simultaneously restrict file transfers to design teams from external and untrusted sources. Within 7 days, issue targeted security awareness communications to Illustrator users highlighting file-opening risks, deploy email filtering rules to flag suspicious attachments, and disable auto-open features in Illustrator where feasible. Within 30 days, formalize file-handling procedures for design workflows, continuously monitor Adobe security advisories for patch availability, and evaluate short-term alternatives or version downgrades if organizational risk tolerance does not permit continued use of unpatched versions.

Adobe Illustrator CVE-2026-48335

EUVD-2026-44563 HIGH

Out-of-bounds Write (CWE-787)

2026-07-14 psirt@adobe.com

GHSA-g44r-x3wp-8593

Memory Corruption Buffer Overflow RCE Illustrator

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local file must be opened by the victim (AV:L, UI:R) with no attacker privileges (PR:N); memory-corruption RCE yields full user-context compromise, so C/I/A all High.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (adobe).

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 11:04 vuln.today

CVE Published

Jul 14, 2026 - 22:17 nvd

HIGH 7.8

DescriptionCVE.org

Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows a remote attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) with total technical impact per CISA SSVC, but no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile). Exploitation hinges on user interaction, so it is a file-delivery/social-engineering vector rather than a remotely automatable one.

Technical ContextAI

Adobe Illustrator is a desktop vector-graphics application that parses a wide range of complex file formats (AI, PDF, SVG, EPS, and imported raster/asset data). The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application's file-parsing logic writes past the bounds of an allocated buffer - typically because a length, offset, or index field taken from attacker-controlled file data is trusted without validation. Overwriting adjacent heap or stack memory can corrupt control data (function pointers, vtables, return addresses) and be leveraged for arbitrary code execution. The tags (Buffer Overflow, Memory Corruption, RCE) reinforce this as a classic parser memory-safety defect. CPE data confirms the affected component is cpe:2.3:a:adobe:illustrator across all sub-versions, i.e. the desktop Illustrator application itself rather than a plugin or cloud service.

RemediationAI

Vendor-released patch: update Illustrator Desktop 2025 to version 29.8.9 and Illustrator Desktop 2026 to version 30.6 as published in Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); apply via the Creative Cloud desktop app or enterprise Admin Console. Until patching is complete, treat the vulnerability as file-borne: do not open Illustrator, PDF, SVG, or EPS files received from untrusted or unsolicited sources, and route externally-supplied design assets through a sandboxed or isolated review workstation before opening on production endpoints - the trade-off is added workflow friction and slower handling of legitimate external files. Because exploitation requires the user to open a crafted file, email/gateway filtering and user awareness of unexpected design-file attachments materially reduce risk, but these are compensating controls only and do not remove the underlying flaw, so upgrading remains the definitive fix.