Uncontrolled search path in Adobe Illustrator CC
Priority LOW 35CWE-427Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-427.
Summary
Adobe Illustrator CC versions 23.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege escalation.
Why it matters now
EPSS 0.00779 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Adobe Illustrator CC | 23.1 and earlier versions | — | No fix listed | CNA |
- Adobe Illustrator CC VendorAdobe Affected 23.1 and earlier versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-7962
- 2026-10-03 Alias added: GHSA-qf49-whr3-4c4f
References
More Adobe Illustrator Cc vulnerabilities
- TI-2019-05920 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1CRITICAL 9.8
- TI-2019-05919 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1CRITICAL 9.8
- TI-2020-03229 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1HIGH 7.8
- TI-2020-03228 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1HIGH 7.8
- TI-2020-03227 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1HIGH 7.8
- TI-2020-03226 Out-of-bounds write in Adobe Illustrator CC CVSS 3.1HIGH 7.8
Sources
- CVE-2019-7962 · CVE Program
- CVE-2019-7962 · NVD
- FIRST EPSS
- GHSA-qf49-whr3-4c4f · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences