An out‑of‑bounds write flaw in Adobe Illustrator allows an attacker to corrupt memory during file parsing. The vulnerability can be triggered by opening a specially crafted .ai file, which may cause Adobe to write data beyond an allocated buffer. If successful, the attacker could execute arbitrary code with the permissions of the user who opens the file.

Adobe Illustrator versions 29.8.4, 30.1 and all earlier releases are affected. The flaw is specific to the desktop application and is related to the Windows operating system, as indicated by the relevant Common Platform Enumeration strings. No additional bundled processes are mentioned in the available data.

The flaw carries a CVSS score of 7.8, indicating high severity. However, EPSS shows an exploitation probability of less than 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting low current exploitation activity. Attackers must obtain the victim’s cooperation to open the malicious file; therefore, social engineering or phishing campaigns that prompt file opening are the most likely attack vectors.