EUVD-2026-74055
GHSA-95hw-m3w3-vfrp
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
File-open delivery confirms AV:L/UI:R; no attacker credentials needed (PR:N); full C/I/A with S:C reflects scope-escaping code execution.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
3DescriptionCVE.org
Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Illustrator Desktop 2025 and 2026 is possible when a victim opens a specially crafted malicious file, exploiting an Incorrect Authorization flaw (CWE-863) that allows attacker-controlled file content to bypass authorization checks and trigger code execution in the current user's context. The changed-scope designation in the CVSS vector (S:C with C:H/I:H/A:H) indicates the impact extends beyond the Illustrator process itself, consistent with a sandbox or privilege boundary escape. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the victim have Adobe Illustrator Desktop 2026 ≤30.7 or Desktop 2025 ≤29.8.10 installed and actively open an attacker-supplied malicious file - this is the sole enabling condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is significant but bounded by the mandatory user-interaction requirement. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Adobe Illustrator Desktop 2026 version 30.8 or later, or Illustrator Desktop 2025 version 29.8.11 or later, per the vendor's fix versions implied by the affected version ceiling in EUVD-2026-74055 and Adobe advisory APSB26-131 (https://helpx.adobe.com/security/products/illustrator/apsb26-131.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Illustrator 2025/2026 users and issue a security alert prohibiting the opening of design files from external or unverified sources; flag users not to open .ai or related design files from email attachments and external collaboration tools. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today