EUVD-2026-44561
GHSA-hq7p-5vvw-865j
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Trigger is a locally opened malicious file, so AV:L with UI:R; unauthenticated (PR:N), and code execution realistically impacts availability, so A:H rather than Adobe's A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
AnalysisAI
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the context of the current user when a victim opens a maliciously crafted file. The flaw stems from improper input validation (CWE-20) during file parsing and carries a scope-changed CVSS of 9.3, but there is no public exploit identified at time of analysis and EPSS is low at 0.39% (31st percentile). CISA SSVC rates exploitation as none with total technical impact, indicating high potential damage but no observed weaponization.
Technical ContextAI
Adobe Illustrator is a widely used desktop vector-graphics application that parses numerous complex file formats (AI, PDF-compatible, EPS, SVG, and embedded asset streams). The CWE-20 Improper Input Validation root cause means Illustrator fails to correctly validate untrusted content within an opened document, allowing malformed structures to corrupt program state and redirect execution. The affected CPE is cpe:2.3:a:adobe:illustrator across the 2025 and 2026 desktop release trains. The CVSS scope change (S:C) indicates the impact crosses a security boundary beyond the vulnerable parsing component into the broader user session/OS context, consistent with memory-corruption-style code execution triggered through file input.
RemediationAI
Vendor-released patch: upgrade Illustrator 2025 to 29.8.9 and Illustrator 2026 to 30.6 per Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); apply through the Creative Cloud desktop app or enterprise deployment tooling. Until patched, reduce exposure by treating Illustrator files (.ai, .eps, .pdf, .svg) from untrusted or external sources as hostile and blocking or quarantining them at email/web gateways - the trade-off is potential friction for designers who legitimately exchange assets externally. Because exploitation requires a user to open a file, security-awareness guidance to avoid opening unsolicited artwork files and using application allow-listing/EDR to constrain child-process spawning from Illustrator further limits impact; these controls add operational overhead but do not break normal in-house workflows.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Adobe Illustrator version 25.2 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a speciall
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today