Adobe Illustrator up to 28.7.6/29.5.1 stack-based overflow

Summaryinfo

A vulnerability described as critical has been identified in Adobe Illustrator up to 28.7.6/29.5.1. Impacted is an unknown function. Executing a manipulation can lead to stack-based overflow. This vulnerability appears as CVE-2025-49527. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Adobe Illustrator up to 28.7.6/29.5.1. It has been declared as critical. This vulnerability affects an unknown code block. The manipulation with an unknown input leads to a stack-based overflow vulnerability. The CWE definition for the vulnerability is CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Illustrator versions 28.7.6, 29.5.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

The advisory is shared for download at helpx.adobe.com. This vulnerability was named CVE-2025-49527 since 06/06/2025. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 241582 (Adobe Illustrator < 28.7.8 / 29.0.0 < 29.6.0 Multiple Vulnerabilities (APSB25-65)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (241582) and EUVD (EUVD-2025-20735). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Image Processing Software

Vendor

• Adobe

Name

• Illustrator

Version

• 28.7.0
• 28.7.1
• 28.7.2
• 28.7.3
• 28.7.4
• 28.7.5
• 28.7.6
• 29.5.0
• 29.5.1

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion