{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27268", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.387Z", "datePublished": "2026-03-10T22:56:43.052Z", "dateUpdated": "2026-08-27T22:09:31.084Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}]}], "datePublic": "2026-03-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:31.084Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Illustrator | Out-of-bounds Read (CWE-125)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-11T13:47:49.319004Z", "id": "CVE-2026-27268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:47:55.976Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-11T13:47:49.319004Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:47:52.232Z"}}], "cna": {"title": "Illustrator | Out-of-bounds Read (CWE-125)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 5.5, "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.5, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Illustrator Desktop 2026", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "30.1"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Illustrator Desktop 2025", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "29.8.4"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:31.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27268", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:09:31.084Z", "dateReserved": "2026-02-18T22:02:41.387Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-03-10T22:56:43.052Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "434133D9-8581-4CAB-837F-DD5DDA87235C", "versionEndExcluding": "29.8.5", "versionStartIncluding": "29.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F0AF185-0F89-4C28-9594-03A31553CE24", "versionEndExcluding": "30.2", "versionStartIncluding": "30.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones 29.8.4, 30.1 y anteriores de Illustrator est\u00e1n afectadas por una vulnerabilidad de lectura fuera de l\u00edmites que podr\u00eda conducir a la exposici\u00f3n de memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para acceder a informaci\u00f3n sensible almacenada en la memoria. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27268", "lastModified": "2026-08-28T00:17:09.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27268", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T13:47:49.319004Z", "version": "2.0.3"}}]}, "published": "2026-03-10T23:16:43.907", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,30.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Illustrator", "source": "cna", "vendor": "Adobe"}, "product": "illustrator", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-16T09:21:21.242006+00:00", "value": {"mitigation_remediation": ["Download and install the Adobe Illustrator update referenced in the Adobe Security Bulletin APSB26\u201118.", "Avoid opening AI files from untrusted or unknown sources; use email attachment blockers or sandbox to test files before opening.", "Implement a security policy that only permits opening signed Illustrator files or requires user confirmation before opening AI files from external locations."], "summary": {"action": "Patch Now", "impact": "Out-of-bounds Read that could expose memory contents"}, "threat_synthesis": {"affected_systems": "All versions of Adobe Illustrator up to and including 29.8.4 and 30.1, running on Microsoft Windows, are affected. The flaw does not impact other Adobe products or non\u2011Windows platforms, as the security advisory references Windows environments in its impact statement.", "description_and_impact": "Adobe Illustrator versions 29.8.4, 30.1 and earlier contain an out\u2011of\u2011bounds read flaw that could expose data stored in memory. An attacker who tricks a user into opening a crafted AI file can read arbitrary memory within the Illustrator process. This flaw may reveal sensitive information such as credentials or proprietary data, but does not provide code execution or system compromise.", "risk_and_exploitability": "The CVSS score of 5.5 indicates a medium severity, and the EPSS score of less than 1% suggests that exploitation is unlikely at present. Because the vulnerability requires the victim to open a malicious file, successful exploitation depends on user interaction and the presence of a crafted AI file. The issue is not listed in the CISA KEV catalog, implying no evidence of widespread exploitation so far. Nonetheless, the memory exposure could leak confidential information that could be used in further attacks."}}}}, "created": "2026-03-11T11:49:00.091543+00:00", "updated": "2026-04-16T09:30:06.042085+00:00", "vendors": ["adobe", "adobe$PRODUCT$illustrator"]}