CVE-2026-21288: Adobe Illustrator

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Illustrator versions 29.8.3, 30.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application, causing disruption to services. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Affected products

• Adobe Illustrator: from 29.0, before 29.8.4 (fixed in 29.8.4); version 30.0 only

Published 2026-01-13. Last modified 2026-08-28.