A critical input validation vulnerability in Adobe Illustrator allows attackers to achieve arbitrary code execution by tricking users into opening a specially crafted file.

The application fails to properly validate input (CWE-20), which can be leveraged to achieve arbitrary code execution. Exploitation requires user interaction via the opening of a malicious file, and the vulnerability impacts the security scope.

An attacker who successfully exploits this vulnerability can execute arbitrary code with the permissions of the current user. This could lead to full system compromise, the installation of malware, or the theft of sensitive local data. The CVSS score of 9.3 reflects the high impact on confidentiality and integrity, making this a significant threat to workstations within the enterprise.

Immediate Action: Update Adobe Illustrator Desktop 2026 to version 30.6 or later, and Illustrator Desktop 2025 to version 29.8.9 or later.

Proactive Monitoring: Monitor endpoint activity for unusual process spawns originating from the Illustrator application process.

Compensating Controls: Implement file integrity monitoring and ensure that users do not open untrusted files from unknown or unverified sources.

Public Exploit Available: exploit_available (unknown)

System administrators should ensure all instances of Adobe Illustrator are patched to the specified versions immediately. Given the risk of arbitrary code execution, this update should be treated as a high priority for all design and creative workstations.