EUVD-2026-74054
GHSA-frvw-x7xf-2p89
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parse trigger needs no host privileges but requires local file access and active user interaction; full C/I/A impact from user-context code execution.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Out-of-bounds write (CWE-787) in Adobe Illustrator Desktop 2025 (≤29.8.10) and 2026 (≤30.7) enables arbitrary code execution in the context of the logged-in user. The attack is triggered by opening a specially crafted document, making phishing attachments and compromised file-sharing platforms viable delivery mechanisms against creative and design professionals. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open a specially crafted file using Adobe Illustrator Desktop 2025 (≤29.8.10) or 2026 (≤30.7). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) accurately characterizes the threat profile: full confidentiality, integrity, and availability impact achieved with low attack complexity and no required privileges, gated only by the need for the victim to open a malicious file. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Users should update Adobe Illustrator Desktop immediately to a version exceeding 29.8.10 (2025 line) or 30.7 (2026 line) as directed by Adobe Security Bulletin APSB26-131 at https://helpx.adobe.com/security/products/illustrator/apsb26-131.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, alert Illustrator users (2025 ≤29.8.10, 2026 ≤30.7) to avoid opening unsolicited design files and restrict document sources to verified internal teams or trusted external partners. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today