A critical Untrusted Search Path vulnerability in Adobe Illustrator allows attackers to execute arbitrary code on a victim's system, necessitating immediate software updates.

The application utilizes an insecure search path to locate critical resources, which can be manipulated by an attacker to execute a malicious program. Exploitation requires user interaction, specifically opening a crafted file, and results in arbitrary code execution in the context of the current user.

The potential for arbitrary code execution poses a severe risk to organizational security, as it grants an attacker the ability to compromise the local machine, access sensitive user data, or move laterally within the network. With a CVSS score of 8.6, this vulnerability represents a high-severity risk that could lead to full system compromise if left unaddressed.

Immediate Action: Update Adobe Illustrator Desktop 2026 to version 30.1 or later, and Adobe Illustrator Desktop 2025 to version 29.8.4 or later.

Proactive Monitoring: Review endpoint security logs for unauthorized file executions or unusual process creation events originating from the Illustrator application process.

Compensating Controls: Ensure endpoint protection software is configured to block unauthorized applications and enforce strict file execution policies to prevent the execution of untrusted binaries.

Public Exploit Available: No (exploit_available: unknown)

Given the high CVSS score and the potential for arbitrary code execution, organizations should prioritize the deployment of the provided vendor patches. Administrators must ensure that all instances of Adobe Illustrator are updated to the specified secure versions to eliminate the risk of exploitation via malicious files.