Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that allows an attacker to execute arbitrary code in the context of the current user. The flaw stems from the application searching for helper executables in directories that an attacker can control, enabling code injection if a malicious file is opened. The impact is full compromise of the user’s system and any data the user can access.

Adobe Illustrator, versions 29.8.4, 30.1 and all earlier releases, running on Windows operating systems. The vulnerability is tied to the Windows search path resolution and therefore applies to any installation on that platform where the specified versions are present.

This weakness receives a high severity CVSS score of 8.6, indicating significant risk. However, its EPSS score is below 1 % and it is not listed in the CISA Known Exploited Vulnerabilities catalog, reflecting a low probability of current real-world exploitation. The attack requires user interaction – the victim must open a specially crafted Illustrator file – which reduces the likelihood that malware will propagate autonomously. Nonetheless, because successful exploitation results in arbitrary code execution under the victim’s account, the potential damage is substantial.