Illustrator Bug: Arbitrary Code Execution via Malicious Files

The National Vulnerability Database (NVD) has flagged a critical vulnerability, CVE-2026-34618, impacting Adobe Illustrator versions 30.2, 29.8.5, and earlier. This isn’t some minor bug; we’re talking about an out-of-bounds write that can lead to arbitrary code execution. In layman’s terms, an attacker could potentially run their own code on a victim’s system, all within the context of the current user.

Rated with a CVSS score of 7.8 (HIGH), this vulnerability, categorized under CWE-787, is serious business. While it does require user interaction – specifically, a victim needs to open a malicious Illustrator file – that’s a common enough attack vector. Phishing campaigns, malvertising, or even compromised legitimate sources could easily distribute such files. It’s a prime example of why application security, especially for creative suites, can’t be an afterthought.