Adobe Illustrator versions 29.8.6, 30.3 and earlier contain an out‑of‑bounds read flaw that can expose sensitive memory to a hostile user. The vulnerability is a classic CWE‑125 scenario, where reading beyond a buffer boundary can reveal confidential data. If exploited, an attacker could obtain private information from the victim’s system, potentially compromising user privacy and data integrity. The impact is limited to informational leakage, not outright code execution.

Adobe’s Illustrator product, specifically versions 29.8.6, 30.3 and all earlier releases. No other Adobe suites are listed as affected.

The CVSS base score of 5.5 indicates moderate severity; the EPSS score is currently unavailable, giving no concrete estimate of real‑world exploitation likelihood. The vulnerability is not listed in CISA’s KEV catalog, suggesting no public exploits are known. Exploitation requires a victim to open a specially crafted file, indicating user interaction is a prerequisite and the attack vector is mainly a malicious file that a user must voluntarily open.