EUVD-2026-29616
GHSA-27qv-6m8p-ww7g
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with required user interaction (UI:R) and no prior privileges (PR:N); memory-corruption RCE as current user yields full C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Illustrator 29.8.6, 30.3 and earlier arises from an out-of-bounds write (CWE-787) triggered when a victim opens a maliciously crafted file, running code in the context of the current user. Only local file-open exploitation applies (CVSS 7.8, AV:L), and there is no public exploit identified at time of analysis; EPSS is very low at 0.03% (7th percentile) and CISA SSVC lists exploitation as none, indicating no observed attacks despite total technical impact.
Technical ContextAI
Adobe Illustrator is a widely-used vector graphics editor that parses numerous complex file formats (AI, PDF, SVG, EPS, and imported image assets) through native C/C++ parsing routines. The root cause is CWE-787 (Out-of-bounds Write): while parsing attacker-controlled file structures, the application writes past the bounds of an allocated buffer - typically due to insufficient validation of length/size fields or index values in the file - corrupting adjacent heap or stack memory. This class of memory-corruption bug (tagged here as Buffer Overflow / Memory Corruption / RCE) is a common vector for control-flow hijacking, since a controlled OOB write can overwrite function pointers, object metadata, or return structures leading to arbitrary code execution. The CPE data (cpe:2.3:a:adobe:illustrator:*) confirms the desktop application itself, across unspecified version ranges up to the fixed builds, is the affected component.
RemediationAI
Upgrade Adobe Illustrator to the fixed release published in Adobe security bulletin APSB26-51 (https://helpx.adobe.com/security/products/illustrator/apsb26-51.html) - apply the version newer than 29.8.6 and 30.3 for your respective release track via the Creative Cloud desktop app or enterprise deployment tooling; the exact fixed build numbers should be confirmed directly from APSB26-51 as they are not enumerated in the source data. Because exploitation requires opening a malicious file, effective compensating controls until patching completes include: instructing users not to open Illustrator files (AI/EPS/PDF/SVG and imported assets) from untrusted or unsolicited sources, which trades off legitimate workflow friction; handling suspicious files only in an isolated/sandboxed VM or non-privileged account to contain any code execution to a low-value context; and applying email/web gateway filtering or content-disarm on inbound design files, accepting that this may quarantine legitimate assets. Standard OS memory protections (ASLR/DEP) are already in effect and are not a substitute for the vendor patch.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today