EUVD-2026-44564
GHSA-2844-cqr7-733q
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Malicious-file delivery makes it local (AV:L) with required victim interaction (UI:R); no attacker auth (PR:N); memory-corruption RCE yields full C/I/A in the current-user context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe Illustrator Desktop (2025 versions ≤29.8.7 and 2026 versions ≤30.5) stems from an out-of-bounds write when parsing a maliciously crafted file, letting an attacker run code in the context of the current user. Exploitation requires the victim to open a booby-trapped file, so it is a file-format/client-side attack rather than a remotely reachable service flaw. No public exploit has been identified at time of analysis (SSVC exploitation: none), and EPSS is low at 0.14% (4th percentile).
Technical ContextAI
The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class in which the application writes past the bounds of an allocated buffer - here reachable through Illustrator's file/asset parsing routines (tagged Buffer Overflow and Memory Corruption). Adobe Illustrator is a widely used desktop vector-graphics editor that ingests many complex file formats (AI, PDF, EPS, SVG and embedded assets), and malformed structures in such files can drive an attacker-controlled write. The affected products per CPE are cpe:2.3:a:adobe:illustrator (Illustrator Desktop 2025 and 2026 tracks). A controlled out-of-bounds write can corrupt adjacent heap metadata or function pointers, which is the mechanism by which the SSVC 'total' technical impact - full loss of confidentiality, integrity and availability - is achieved.
RemediationAI
Apply the vendor-released patch: upgrade Adobe Illustrator 2025 to version 29.8.9 or later, and Illustrator 2026 to version 30.6 or later, per Adobe advisory APSB26-79 (https://helpx.adobe.com/security/products/illustrator/apsb26-79.html); Creative Cloud desktop app users should run the update through the CC updater. Because exploitation requires opening a malicious file, effective compensating controls until patching is complete are to instruct users not to open Illustrator files (.ai, .eps, .pdf, .svg and embedded assets) from untrusted or unsolicited sources, and to open questionable files only on an isolated or sandboxed workstation without sensitive data or network access. Email/web gateways can quarantine or flag inbound design files from external senders; the trade-off is potential friction for design teams that legitimately exchange large asset files with clients and contractors.
More in Illustrator
View allAdobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to e
Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption)
Arbitrary code execution in Adobe Illustrator 2025 (≤29.8.7) and 2026 (≤30.5) allows an attacker to run code in the cont
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially c
Adobe Illustrator version 25.2 (and earlier) is affected by a Path Traversal vulnerability when parsing a specially craf
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today