Product:
Illustrator
Summary
Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2026-21333 |
Exploitation
To exploit this vulnerability, an attacker must create a malicious file that, when opened by the victim using an affected version of Illustrator, can execute arbitrary code. The attack relies on the victim’s interaction to open the file, which then allows the attacker to run code with the same privileges as the user.
Affected Products
- Illustrator 29.8.4: Affected by the Untrusted Search Path vulnerability.
- Illustrator 30.1: Affected by the Untrusted Search Path vulnerability.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure they are using the latest version of Illustrator. Regularly updating software can help protect against known vulnerabilities.