Adobe Illustrator versions 30.2, 29.8.5 and any earlier releases are susceptible to an out‑of‑bounds write that permits an attacker to run arbitrary code with the privileges of the user opening the file. The flaw arises when malformed document data is processed, causing a memory corruption that a malicious designer could exploit. This bug is a classic instance of CWE‑787, where unsafe memory handling leads to executable code injection.

The affected product is Adobe Illustrator, specifically all releases up to and including version 30.2 and 29.8.5. Users who are running any of these versions on Windows, macOS, or other supported operating systems are potentially vulnerable if they use the application to open files.

The vulnerability carries a CVSS score of 7.8, indicating a high potential for damage if exploited. While an EPSS probability score is not listed, known exploitation requires the victim to open a specially crafted file, meaning user interaction is mandatory. The flaw is not currently catalogued by CISA as a known exploited vulnerability, but the severity rating and the capability for arbitrary code execution warrant serious attention. An attacker could host malicious assets or embed them in a shared document, and any legitimate use of Illustrator could unleash executable payloads.