CVE-2026-21280

CVSS v3 8.6 HIGH

8.6^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

I

llustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed.

References

Link	Resource
https://helpx.adobe.com/security/products/illustrator/apsb26-03.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:illustrator::::::::
	cpe:2.3:a:adobe:illustrator:30.0:::::::*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

14 Jan 2026, 19:28

Type	Values Removed	Values Added
References	~~() https://helpx.adobe.com/security/products/illustrator/apsb26-03.html -~~	() https://helpx.adobe.com/security/products/illustrator/apsb26-03.html - Vendor Advisory
First Time		Microsoft windows Apple macos Adobe illustrator Apple Microsoft Adobe
CPE		cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:a:adobe:illustrator:30.0:::::::* cpe:2.3:o:apple:macos:-:::::::* cpe:2.3:a:adobe:illustrator::::::::

13 Jan 2026, 19:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 19:16

Updated : 2026-01-14 19:28

NVD link : CVE-2026-21280

Mitre link : CVE-2026-21280

CVE.ORG link : CVE-2026-21280

JSON object : View

Products Affected

macos

illustrator

windows

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2026-21280", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.8}]}, "published": "2026-01-13T19:16:25.693", "references": [{"url": "https://helpx.adobe.com/security/products/illustrator/apsb26-03.html", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.3, 30.0 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file and scope is changed."}], "lastModified": "2026-01-14T19:28:23.530", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "51DBEB22-5A04-40DC-BF47-0A6711977FBA", "versionEndExcluding": "29.8.4", "versionStartIncluding": "29.0"}, {"criteria": "cpe:2.3:a:adobe:illustrator:30.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7239093D-0266-4AFA-BA6C-94F6593E0B4B"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "[email protected]"}