CVE-2026-34662
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A NULL Pointer Dereference vulnerability in Illustrator versions 29.8.6, 30.3 and earlier could lead to a denial-of-service (DoS) condition via application crash. Exploitation requires user interaction to open a malicious file.
Risk Assessment
The risk involves an attacker potentially causing a crash of Illustrator, disrupting user work and potentially leading to loss of unsaved data.
Recommendation
It is recommended to immediately update Adobe Illustrator to the latest available version that includes a fix for this vulnerability.
Other vulnerabilities in Adobe Illustrator
See all- CVE-2026-48334Critical
An Improper Input Validation vulnerability in Illustrator could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The scope is changed, potentially allowing an attacker to gain elevated access or control over the victim's account or session.
- CVE-2026-48337High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48336High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48335High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48275High
Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction as a victim must open a malicious file. The scope is changed.
- CVE-2026-34687High
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34663Medium
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction, as a victim must open a malicious file.
- CVE-2026-34661High
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34618High
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability. An attacker can exploit this to execute arbitrary code in the context of the current user if the victim opens a malicious file.
- CVE-2026-27270Medium
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.
Original NVD description (English source)
Illustrator versions 29.8.6, 30.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.