The vulnerability arises from Adobe Illustrator’s handling of untrusted search paths when locating critical resources such as executable programs. The application does not verify that the program found on the search path comes from a trusted directory, allowing an attacker to place a malicious executable in a location the path resolves to. If a victim opens a crafted file, Illustrator will launch that program in the context of the current user, enabling arbitrary code execution.

Adobe Illustrator versions 29.8.3, 30.0 and every earlier release on macOS and Windows are affected.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The flaw requires user interaction, so it is not a remote exploit but can be targeted to individual users who open malicious files. It is not listed in the CISA KEV catalog, but due to the high impact of execution, organizations should treat it as a critical issue.