CVE-2026-27270

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27270", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.387Z", "datePublished": "2026-03-10T22:56:45.337Z", "dateUpdated": "2026-08-27T22:09:47.904Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}]}], "datePublic": "2026-03-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:47.904Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Illustrator | Out-of-bounds Read (CWE-125)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:57:14.615484Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:08:14.877Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27270", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-11T03:57:14.615484Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-11T13:01:50.230Z"}}], "cna": {"title": "Illustrator | Out-of-bounds Read (CWE-125)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 5.5, "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.5, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Illustrator Desktop 2026", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "30.1"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Illustrator Desktop 2025", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "29.8.4"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-03-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:09:47.904Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27270", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:09:47.904Z", "dateReserved": "2026-02-18T22:02:41.387Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-03-10T22:56:45.337Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Illustrator Desktop 2026", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "30.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "30.2", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Illustrator Desktop 2025", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "29.8.4", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "29.8.5", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "434133D9-8581-4CAB-837F-DD5DDA87235C", "versionEndExcluding": "29.8.5", "versionStartIncluding": "29.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:illustrator:*:*:*:*:*:*:*:*", "matchCriteriaId": "1F0AF185-0F89-4C28-9594-03A31553CE24", "versionEndExcluding": "30.2", "versionStartIncluding": "30.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Illustrator versions 29.8.4, 30.1 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones 29.8.4, 30.1 y anteriores de Illustrator est\u00e1n afectadas por una vulnerabilidad de lectura fuera de l\u00edmites que podr\u00eda conducir a la exposici\u00f3n de memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para acceder a informaci\u00f3n sensible almacenada en la memoria. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27270", "lastModified": "2026-08-28T00:17:10.027", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27270", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-11T03:57:14.615484Z", "version": "2.0.3"}}]}, "published": "2026-03-10T23:16:44.073", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/illustrator/apsb26-18.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,30.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Illustrator", "source": "cna", "vendor": "Adobe"}, "product": "illustrator", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-16T03:02:04.849886+00:00", "value": {"mitigation_remediation": ["Apply the latest Adobe Illustrator security update as per the Adobe Security Bulletin.", "Update Illustrator to the most recent version (29.8.5 or later; 30.2 or later) to close the vulnerability.", "Restrict users from opening unknown or untrusted files or implement a file scanning solution before opening files in Illustrator."], "summary": {"action": "Apply Patch", "impact": "Memory exposure via out-of-bounds read"}, "threat_synthesis": {"affected_systems": "The affected product is Adobe Illustrator on Windows. Specific vulnerable releases are version 29.8.4, 30.1, and all earlier iterations. No other Adobe or Microsoft Windows products are impacted according to the provided data.", "description_and_impact": "Adobe Illustrator versions 29.8.4, 30.1 and earlier contain an out-of-bounds read vulnerability (CWE-125) that can expose the contents of memory. An attacker who convinces a user to open a malicious file can read sensitive data stored in the victim\u2019s process memory. The flaw manifests as an improper bounds check when processing certain file elements.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not present in CISA\u2019s KEV catalog. Because exploitation requires the user to open a malicious file, the threat is limited to environments where users may view unsolicited files, and no remote or unattended exploitation is feasible."}}}}, "created": "2026-03-11T11:39:03.043185+00:00", "updated": "2026-04-16T03:15:22.942357+00:00", "vendors": ["adobe", "adobe$PRODUCT$illustrator"]}