EUVD-2026-44564
GHSA-2844-cqr7-733q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Illustrator file
-
DeliveryDeliver via phishing or shared asset
-
ExploitVictim opens file in Illustrator
-
ExecutionTrigger out-of-bounds write in parser
-
PersistCorrupt memory to hijack control flow
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-crafted malicious file in a vulnerable Adobe Illustrator build (2025 ≤29.8.7 or 2026 ≤30.5) - the CVSS UI:R confirms mandatory user interaction, and AV:L confirms the payload must reach and be opened on the local machine rather than being triggered remotely over a network. There is no authentication requirement on the attacker's side (PR:N applies to the attacker, not the victim), and code runs only at the privilege level of the user who opens the file (S:U, current-user context - not SYSTEM/root). The key limiting factors are: the human-open requirement, the need for a still-unpatched Illustrator version, and the lack of any automated or network-reachable trigger (SSVC automatable: no). |
| Impact | The signals are internally consistent and point to a serious-but-not-emergency issue. The CVSS 7.8 (High) vector is AV:L/UI:R, meaning the 'attack' is delivered as a file the victim must open locally - not network-facing, and gated on user interaction - while the C:H/I:H/A:H impacts match SSVC's 'total' technical impact. Counterbalancing severity: EPSS is only 0.14% (4th percentile), SSVC exploitation is 'none' with automatable 'no', and there is no CISA KEV listing and no public exploit identified. There is no signal conflict to flag: low-privilege PR:N combined with mandatory UI:R correctly models 'anyone can be targeted but a human must open the file.' Net: a real vulnerability warranting scheduled patching, but not evidence of active or imminent mass exploitation; prioritize behind any internet-facing or KEV-listed issues. |
| Exploit ScenarioDerived | An attacker crafts a malicious Illustrator-openable file with malformed structures that trigger the out-of-bounds write, then delivers it via phishing email, a shared design asset, or a compromised download. When a designer opens the file in an unpatched Illustrator, the corruption is leveraged to execute arbitrary code with that user's privileges. No public exploit code has been identified, and the local attack vector plus required user interaction make targeted social-engineering delivery the realistic path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
RemediationAI
Apply the vendor-released patch: upgrade Adobe Illustrator 2025 to version 29.8.9 or later, and Illustrator 2026 to version 30.6 or later, per Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); Creative Cloud desktop app users should run the update through the CC updater. Because exploitation requires opening a malicious file, effective compensating controls until patching is complete are to instruct users not to open Illustrator files (.ai, .eps, .pdf, .svg and embedded assets) from untrusted or unsolicited sources, and to open questionable files only on an isolated or sandboxed workstation without sensitive data or network access. Email/web gateways can quarantine or flag inbound design files from external senders; the trade-off is potential friction for design teams that legitimately exchange large asset files with clients and contractors.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - here reachable through Illustrator's file/asset parsing routines (tagged Buffer Overflow and Memory Corruption). Adobe Illustrator is a widely used desktop vector-graphics editor that ingests many complex file formats (AI, PDF, EPS, SVG and embedded assets), and malformed structures in such files can drive an attacker-controlled write. The affected products per CPE are cpe:2.3:a:adobe:illustrator (Illustrator Desktop 2025 and 2026 tracks). A controlled out-of-bounds write can corrupt adjacent heap metadata or function pointers, which is the mechanism by which the SSVC 'total' technical impact - full loss of confidentiality, integrity and availability - is achieved.
Know when Illustrator gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious-file delivery makes it local (AV:L) with required victim interaction (UI:R); no attacker auth (PR:N); memory-corruption RCE yields full C/I/A in the current-user context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Illustrator Desktop (2025 versions through 29.8.7 and 2026 versions through 30.5) contains a high-severity arbitrary code execution vulnerability triggered when users open maliciously crafted files. No public exploit has been identified at time of analysis, but the flaw exposes design and creative teams to potential system compromise. With no patch currently available from Adobe, immediate user awareness and file-handling controls are essential to minimize exploitation risk.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) user awareness training emphasizing the risk of opening files from external or untrusted sources; (2) if organizationally feasible, restrict Illustrator access to users for whom the tool is mission-critical; (3) monitor network and endpoint telemetry for suspicious Illustrator behavior or unexpected process execution; (4) consider application sandboxing or containerization where supported; (5) maintain regular backups to enable recovery if compromise occurs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Exploit-DB