Adobe Illustrator up to 29.8.3/30.0 untrusted search path

Summaryinfo

A vulnerability marked as problematic has been reported in Adobe Illustrator up to 29.8.3/30.0. This impacts an unknown function. This manipulation causes untrusted search path. This vulnerability is registered as CVE-2026-21280. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in Adobe Illustrator up to 29.8.3/30.0. It has been declared as critical. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.

It is possible to read the advisory at helpx.adobe.com. This vulnerability is known as CVE-2026-21280 since 12/12/2025. The exploitation appears to be difficult. Attacking locally is a requirement. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1574 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 283672 (Adobe Illustrator < 29.8.4 / 30.0 < 30.1 Multiple Vulnerabilities (APSB26-03)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (283672). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Image Processing Software

Vendor

• Adobe

Name

• Illustrator

Version

• 29.8.0
• 29.8.1
• 29.8.2
• 29.8.3
• 30.0

License

• commercial

Website

• Vendor: https://www.adobe.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion