CVE-2026-34687
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Risk Assessment
This vulnerability could lead to unauthorized access to the system and execution of malicious code, posing a serious threat to the organization's security.
Recommendation
It is recommended to update to the latest version of Illustrator to mitigate the risk associated with this vulnerability. Users should also be warned against opening unknown or suspicious files.
Other vulnerabilities in Adobe Illustrator
See all- CVE-2026-48334Critical
An Improper Input Validation vulnerability in Illustrator could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The scope is changed, potentially allowing an attacker to gain elevated access or control over the victim's account or session.
- CVE-2026-48337High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48336High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48335High
Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-48275High
Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction as a victim must open a malicious file. The scope is changed.
- CVE-2026-34663Medium
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation requires user interaction, as a victim must open a malicious file.
- CVE-2026-34662Medium
A NULL Pointer Dereference vulnerability in Illustrator versions 29.8.6, 30.3 and earlier could lead to a denial-of-service (DoS) condition via application crash. Exploitation requires user interaction to open a malicious file.
- CVE-2026-34661High
Illustrator versions 29.8.6, 30.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
- CVE-2026-34618High
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability. An attacker can exploit this to execute arbitrary code in the context of the current user if the victim opens a malicious file.
- CVE-2026-27270Medium
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation requires user interaction – the victim must open a malicious file.
Original NVD description (English source)
Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.