CVE-2026-34663
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction, as a victim must open a malicious file.
Risk Assessment
The risk is potential leakage of sensitive data from Illustrator's memory, which could expose confidential information. However, exploitation requires the user to open a malicious file.
Recommendation
It is recommended to update Adobe Illustrator to the latest available version that includes the fix. Also, inform users about the risks of opening files from untrusted sources.
Other vulnerabilities in Adobe Illustrator
See all- CVE-2026-48334Critical
An Improper Input Validation vulnerability in Illustrator could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The scope is changed, potentially allowing an attacker to gain elevated access or control over the victim's account or session.
- CVE-2026-48337High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48336High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48335High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48275High
Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction as a victim must open a malicious file. The scope is changed.
- CVE-2026-34687High
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34662Medium
A NULL Pointer Dereference vulnerability in Illustrator versions 29.8.6, 30.3 and earlier could lead to a denial-of-service (DoS) condition via application crash. Exploitation requires user interaction to open a malicious file.
- CVE-2026-34661High
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34618High
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability. An attacker can exploit this to execute arbitrary code in the context of the current user if the victim opens a malicious file.
- CVE-2026-27270Medium
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.
Original NVD description (English source)
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.