Illustrator | Untrusted Search Path (CWE-426)
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-426.
Summary
Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Adobe | Illustrator Desktop 2026 | up to 30.0 | 30.1 | Patch available | CNA |
| Adobe | Illustrator Desktop 2025 | up to 29.8.3 | 29.8.4 | Patch available | CNA |
- Illustrator Desktop 2026 VendorAdobe Affected up to 30.0 Fixed in 30.1 Patch available CNA
- Illustrator Desktop 2025 VendorAdobe Affected up to 29.8.3 Fixed in 29.8.4 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:* | 29.0 to before 29.8.4 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:illustrator:30.0:*:*:*:*:*:*:* | 30.0 | Vulnerable | Adobe |
| cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Apple |
| cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
- cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:* Versions 29.0 to before 29.8.4 Vulnerable ·Adobe
- cpe:2.3:a:adobe:illustrator:30.0:*:*:*:*:*:*:* Versions 30.0 Vulnerable ·Adobe
- cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Apple
- cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
Remediation
- Fix · CNA Illustrator Desktop 2026 (Adobe) Fixed in 30.1
- Fix · CNA Illustrator Desktop 2025 (Adobe) Fixed in 29.8.4
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Adobe Illustrator Desktop 2025, Illustrator Desktop 2026 — helpx.adobe.com/security/products/illustrator/apsb26-03.html
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-17192 Illustrator | NULL Pointer Dereference (CWE-476)Priority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2026-21280
- 2026-10-03 Alias added: GHSA-7pj6-2f5q-9w48
References
More Adobe Illustrator vulnerabilities
- TI-2009-03980 Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0… CVSS 2.0HIGH 9.3
- TI-2007-02283 Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3… CVSS 2.0HIGH 9.3
- TI-2007-02162 Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9… CVSS 2.0HIGH 9.3
- TI-2012-00719 Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial… CVSS 2.0HIGH 10.0
- TI-2010-03013 Untrusted search path vulnerability in Adobe Illustrator CS4 14.0.0, CS5 15.0.1 and… CVSS 2.0HIGH 9.3
- TI-2009-03749 Buffer overflow in Adobe Illustrator CS3 13.0.3 and earlier and Illustrator CS4 14.0.0… CVSS 2.0HIGH 10.0
Sources
- CVE-2026-21280 · CVE Program
- CVE-2026-21280 · NVD
- FIRST EPSS
- GHSA-7pj6-2f5q-9w48 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences