Product:
Illustrator
Summary
Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could modify the search path to point to a malicious program, which the application would then execute. Exploitation requires user interaction, as a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2026-21280 |
Exploitation
To exploit this vulnerability, an attacker must convince a user to open a specially crafted file that alters the search path used by Illustrator. Once the user opens the file, the application may execute the malicious program specified in the modified search path, leading to arbitrary code execution with the privileges of the current user.
Affected Products
- Illustrator 29.8.3: Affected by the Untrusted Search Path vulnerability.
- Illustrator 30.0: Affected by the Untrusted Search Path vulnerability.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure that they are using the latest version of Illustrator. Adobe may provide updates or patches to address this issue, so users should regularly check for updates.