CVE-2026-21280
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
Illustrator versions 29.8.3, 30.0 and earlier are affected by an untrusted search path vulnerability that could allow arbitrary code execution in the context of the current user. An attacker could modify the search path to point to a malicious program, which the application would then execute. Exploitation requires user interaction, such as opening a malicious file, and the scope is changed.
Risk Assessment
An attacker could manipulate the search path to execute malicious software in the user's context. The risk includes potential system compromise and a change in security scope.
Recommendation
Update Illustrator to the latest version. Avoid opening files from untrusted sources and monitor the integrity of search paths.
Other vulnerabilities in Adobe Illustrator
See all- CVE-2026-48334Critical
An Improper Input Validation vulnerability in Illustrator could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The scope is changed, potentially allowing an attacker to gain elevated access or control over the victim's account or session.
- CVE-2026-48337High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48336High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48335High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48275High
Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction as a victim must open a malicious file. The scope is changed.
- CVE-2026-34687High
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34663Medium
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction, as a victim must open a malicious file.
- CVE-2026-34662Medium
A NULL Pointer Dereference vulnerability in Illustrator versions 29.8.6, 30.3 and earlier could lead to a denial-of-service (DoS) condition via application crash. Exploitation requires user interaction to open a malicious file.
- CVE-2026-34661High
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34618High
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability. An attacker can exploit this to execute arbitrary code in the context of the current user if the victim opens a malicious file.
Original NVD description (English source)
Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.