CVE-2026-21280CWE-426

CVE-2026-21280

High · published January 14, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
16.8
In the wild
Unconfirmed
What it is

⚡ A crafty attacker only needs you to open a file to execute arbitrary code! This Untrusted Search Path vulnerability in Illustrator could turn your creativity into chaos! Think of it like a restaurant menu that allows customers to order anything they want, even if it's not on the menu — an attacker can sneak in a dish that looks legit but is actually harmful. If you don’t check the source, you’re in for a surprise! 🍽️ If an attacker modifies the search path and you open a malicious file, they can run any code they desire, potentially hijacking your system to steal data or push malware. This could lead to a breach of sensitive information or disruption of your workflow. It’s like giving a stranger your house key — they could do anything inside!

Put simply

Think of it like a restaurant menu that allows customers to order anything they want, even if it's not on the menu — an attacker can sneak in a dish that looks legit but is actually harmful. If you don’t check the source, you’re in for a surprise! 🍽️ This vulnerability in Illustrator allows an attacker to alter the search path for critical resources, enabling arbitrary code execution when a user opens a compromised file. The issue arises in versions 29.8.3, 30.0, and earlier, which fail to validate the search path correctly.

What to do

If an attacker modifies the search path and you open a malicious file, they can run any code they desire, potentially hijacking your system to steal data or push malware. This could lead to a breach of sensitive information or disruption of your workflow. It’s like giving a stranger your house key — they could do anything inside! To protect yourself, immediately update Illustrator to the latest version and avoid opening suspicious files from untrusted sources. Regularly review your security settings and educate yourself about safe file practices to mitigate risks. You've got this! Follow these steps and you'll keep your creative space secure! 🛡️

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00260 · 16.8th percentile
Weakness
CWE-426 · Untrusted Search Path
Published
2026-01-14T00:16Z
Affected products (2)
ProductVersionsFixed in
adobe/illustrator≥ 29.0, < 29.8.429.8.4
adobe/illustratorall versions—
References (1)
EPSS history
Timeline
  • 13 JAN 18:41Z
    Illustrator | Untrusted Search Path (CWE-426)
    cvelistv5