Technical impact
Adobe Illustrator versions 29.8.6, 30.3 and all earlier releases contain a heap‑based buffer overflow that can be triggered by a specially crafted file. When an affected user opens such a file, the overflow can allow arbitrary code to run with the permissions of that user. This vulnerability falls under CWE‑122 and represents a high severity flaw as it can compromise confidentiality, integrity, and availability of the victim’s system.
Affected Systems
Vulnerable systems are those running Adobe Illustrator 29.8.6, 30.3, or any earlier version of the product. The vulnerability does not affect later releases beyond 30.3.
Risk and Exploitability
The cited CVSS score of 7.8 classifies this as high, indicating significant potential damage. Although the EPSS score is not available, the vulnerability requires user interaction – the user must deliberately open a malicious file – which reduces its exploitability in unattended environments but still poses a serious risk in typical office settings. The issue is not listed in the CISA KEV catalog, suggesting that it is not a known, actively exploited vulnerability at this time, but its high impact warrants immediate concern for any user with access to Illustrator.
