CVE-2026-48334
Adobe Illustrator has a flaw that lets attackers run arbitrary code when a user opens a specially crafted file. The attack needs the victim to open the file, but once done it can give the attacker full control of the user’s account or session. This is a serious risk because it can be used to take over the victim’s computer.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Adobe Illustrator on Microsoft Windows (all versions listed in the CPE).
Real-world impact
If a user opens a malicious Illustrator file, the attacker can execute any code on the victim’s machine, potentially taking full control of the user’s account or session.
Why this severity
The CVSS score of 9.3 is high because the flaw can completely compromise confidentiality and integrity of data, and it requires only a single user action to exploit. The score reflects the potential for full system takeover.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 14, 2026 · 19d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 29, 2026 · 4d agoAdvisory updatedThe NVD record was last revised.
How it’s attacked
References & advisories
- helpx.adobe.com/security/products/illustrat…vendor advisory