Adobe Illustrator vulnerabilities

182 CVEs affecting Adobe Illustrator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-75992, published 2026-09-08.

More from Adobe.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2009-4195, published 2009-12-04. High severity, CVSS 9.3. EPSS: 70.7% chance of exploitation in the next 30 days. Buffer overflow in Adobe Illustrator CS4 14.0.0, CS3 13.0.3 and earlier, and CS3 13.0.0 allows remote attackers to execute arbitrary code via a long DSC comment in an Encapsulated PostScript (.eps)…
• CVE-2007-2365, published 2007-04-30. High severity, CVSS 9.3. EPSS: 41.2% chance of exploitation in the next 30 days. Buffer overflow in Adobe Photoshop CS2 and CS3, Photoshop Elements 5.0, Illustrator CS3, and GoLive 9 allows user-assisted remote attackers to execute arbitrary code via a crafted .PNG file.
• CVE-2007-2244, published 2007-04-25. High severity, CVSS 9.3. EPSS: 31.7% chance of exploitation in the next 30 days. Multiple buffer overflows in Adobe Photoshop CS2 and CS3, Illustrator CS3, and GoLive 9 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) BMP, (2) DIB, or (3) RLE file.
• CVE-2010-3152, published 2010-08-27. High severity, CVSS 9.3. EPSS: 16.8% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Adobe Illustrator CS4 14.0.0, CS5 15.0.1 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execute arbitrary code…
• CVE-2012-0780, published 2012-05-09. High severity, CVSS 10.0. EPSS: 15% chance of exploitation in the next 30 days. Adobe Illustrator before CS6 allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, a different vulnerability than CVE-2012-2023,…
• CVE-2021-21105, published 2021-09-08. High severity, CVSS 8.8. EPSS: 8% chance of exploitation in the next 30 days. Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to…
• CVE-2009-3952, published 2010-01-08. High severity, CVSS 10.0. EPSS: 8% chance of exploitation in the next 30 days. Buffer overflow in Adobe Illustrator CS3 13.0.3 and earlier and Illustrator CS4 14.0.0 allows attackers to execute arbitrary code via unspecified vectors.
• CVE-2021-21104, published 2021-09-08. High severity, CVSS 8.8. EPSS: 6.6% chance of exploitation in the next 30 days. Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to…
• CVE-2008-3961, published 2008-09-18. High severity, CVSS 9.3. EPSS: 5.9% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Adobe Illustrator CS2 on Macintosh allow user-assisted attackers to execute arbitrary code via a crafted AI file.
• CVE-2014-0513, published 2014-05-14. High severity, CVSS 10.0. EPSS: 5.6% chance of exploitation in the next 30 days. Stack-based buffer overflow in Adobe Illustrator CS6 before 16.0.5 and 16.2.x before 16.2.2 allows remote attackers to execute arbitrary code via unspecified vectors.

Latest

• CVE-2026-75992, published 2026-09-08. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
• CVE-2026-75991, published 2026-09-08. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to…
• CVE-2026-75990, published 2026-09-08. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to…
• CVE-2026-71441, published 2026-08-25. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information.…
• CVE-2026-48337, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
• CVE-2026-48336, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
• CVE-2026-48335, published 2026-07-14. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
• CVE-2026-48334, published 2026-07-14. Critical severity, CVSS 9.3. EPSS: 1% chance of exploitation in the next 30 days. Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control…
• CVE-2026-48275, published 2026-07-14. High severity, CVSS 8.6. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user…
• CVE-2026-34687, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Illustrator versions 29.8.6, 30.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…