Adobe Illustrator contains a critical out-of-bounds write vulnerability that permits arbitrary code execution when a user opens a specially crafted file.

This is an out-of-bounds write vulnerability (CWE-787) that occurs when the application processes malformed files. The attack requires user interaction, specifically the victim opening a malicious file, but does not require prior authentication.

Successful exploitation allows an attacker to execute arbitrary code within the context of the logged-in user. This could lead to a total compromise of the local workstation, unauthorized access to sensitive design files, and potential pivot points into the broader corporate network. With a CVSS score of 7.8, this vulnerability represents a high risk to business operations and data confidentiality.

Immediate Action: Update Adobe Illustrator to the latest version as specified in the official Adobe security bulletin APSB25-109 to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected file system modifications initiated by the Illustrator application.

Compensating Controls: Implement robust email and endpoint security controls to scan incoming files for malicious content, and enforce the principle of least privilege to limit the impact if a user workstation is compromised.

Public Exploit Available: No (exploit_available: false)

Given the potential for arbitrary code execution, organizations must prioritize updating Adobe Illustrator across all managed endpoints. Security teams should verify that all installations are at or above the version specified in the vendor advisory to effectively mitigate this high-risk threat.