Adobe Illustrator up to 28.7.4/29.2.1 untrusted search path

Summaryinfo

A vulnerability described as problematic has been identified in Adobe Illustrator up to 28.7.4/29.2.1. The impacted element is an unknown function. Executing a manipulation can lead to untrusted search path. This vulnerability is handled as CVE-2025-27167. It is possible to launch the attack on the local host. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability has been found in Adobe Illustrator up to 28.7.4/29.2.1 and classified as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.

The advisory is shared for download at helpx.adobe.com. This vulnerability was named CVE-2025-27167 since 02/19/2025. The exploitation appears to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1574.

The vulnerability scanner Nessus provides a plugin with the ID 232593 (Adobe Illustrator < 28.7.5 / 29.0.0 < 29.3.0 Multiple Vulnerabilities (APSB25-17)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (232593). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Image Processing Software

Vendor

• Adobe

Name

• Illustrator

Version

• 28.7.0
• 28.7.1
• 28.7.2
• 28.7.3
• 28.7.4
• 29.2.0
• 29.2.1

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion