Description
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-07-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Illustrator contains an out‑of‑bounds write flaw that is triggered by opening a malicious file. The bug permits an attacker to overwrite adjacent memory, which can allow execution of arbitrary code in the context of the user opening the file.

Affected Systems

Adobe Illustrator Desktop 2025 and Adobe Illustrator Desktop 2026 are affected.

Risk and Exploitability

The CVSS score of 7.8 classifies this as high severity. The EPSS score of less than 1% indicates a low likelihood that exploits are currently active, and the vulnerability is not listed in the CISA KEV catalog. Because it requires a user to open a crafted file, the attack vector is local and user‑interaction dependent; no remote execution path is known.

Generated by OpenCVE AI on July 31, 2026 at 04:37 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Adobe security update for Illustrator Desktop 2025 and 2026 as detailed in the APSB26‑79 advisory.
  • Restrict Illustrator from automatically opening files from untrusted sources and/or disable automatic file previews when possible.
  • Place Illustrator in a sandbox or run it within a container when processing files from unknown origins.

Generated by OpenCVE AI on July 31, 2026 at 04:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 13:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe illustrator Desktop 2025
Adobe illustrator Desktop 2026
Vendors & Products Adobe
Adobe illustrator Desktop 2025
Adobe illustrator Desktop 2026

Wed, 15 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Description Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Illustrator | Out-of-bounds Write (CWE-787)
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Illustrator Desktop 2025 Illustrator Desktop 2026
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-07-15T10:40:51.767Z

Reserved: 2026-05-21T15:28:38.139Z

Link: CVE-2026-48336

cve-icon Vulnrichment

Updated: 2026-07-15T10:40:46.006Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-31T04:45:17Z

Weaknesses