EUVD-2026-44562
GHSA-pmjq-98wp-vqxv
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open exploitation (AV:L, UI:R) with no privileges (PR:N) and low complexity; memory-corruption RCE yields total impact to the user (C/I/A:H, scope unchanged).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw is an out-of-bounds write (CWE-787) triggered during file parsing and requires user interaction, so it is not remotely exploitable without victim action. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Technical ContextAI
The vulnerability lies in Adobe Illustrator's desktop file-parsing code, which handles vector graphics document formats (e.g., AI, and imported/embedded asset formats). The root cause is CWE-787 (Out-of-bounds Write): while processing a malformed file, the application writes data past the bounds of an allocated buffer, corrupting adjacent memory. This class of memory-corruption bug can overwrite control data (pointers, function tables, saved return addresses), which a carefully crafted file can leverage to redirect execution and achieve arbitrary code execution. The CPE data confirms the affected component is cpe:2.3:a:adobe:illustrator across all sub-versions within the listed ranges. Tags corroborate the mechanism: Buffer Overflow, Memory Corruption, RCE.
RemediationAI
Vendor-released patch: upgrade Adobe Illustrator 2025 to version 29.8.9 or later, and Illustrator 2026 to version 30.6 or later, per Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); use the Creative Cloud desktop app or enterprise deployment tooling to push the update. Until patching is complete, the effective compensating control is user-behavior hardening: instruct users not to open Illustrator files (.ai and imported assets) received from untrusted or unsolicited sources, and handle suspect files only in an isolated/sandboxed environment or VM, with the trade-off of workflow friction for designers. Because exploitation requires opening a malicious file, email/gateway filtering and blocking of untrusted document delivery channels reduces the delivery surface, at the cost of potentially quarantining legitimate design assets. There is no server-side setting to disable, so patching is the definitive remediation.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today