Illustrator 29.8.4, 30.1, and earlier contain a heap‑based buffer overflow that can lead to arbitrary code execution when a user opens a crafted file. The flaw allows an attacker to corrupt memory on the heap, potentially executing arbitrary instructions in the context of the current user. The exploitation vector requires user interaction – the victim must open a malicious graphic file.

Adobe Illustrator installations that run on Microsoft Windows users of versions 29.8.4, 30.1, and earlier are affected; these versions are present on Windows desktops and workstations.

The vulnerability has a CVSS score of 7.8, indicating high severity. The EPSS probability is below 1 %, suggesting that exploitation is unlikely but not impossible. Because the vector requires the victim to open a malicious file, the primary risk is malicious social‑engineering or phishing campaigns. The flaw is not listed in CISA’s KEV catalog, so no widespread known exploits have been reported. The risk remains moderate, primarily due to the need for user interaction.