Adobe Illustrator versions 29.8.4, 30.1 and earlier contain an out-of-bounds read vulnerability (CWE-125) that can expose the contents of memory. An attacker who convinces a user to open a malicious file can read sensitive data stored in the victim’s process memory. The flaw manifests as an improper bounds check when processing certain file elements.

The affected product is Adobe Illustrator on Windows. Specific vulnerable releases are version 29.8.4, 30.1, and all earlier iterations. No other Adobe or Microsoft Windows products are impacted according to the provided data.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not present in CISA’s KEV catalog. Because exploitation requires the user to open a malicious file, the threat is limited to environments where users may view unsolicited files, and no remote or unattended exploitation is feasible.