CVE-2023-47075
Published: 13 December 2023
Summary
CVE-2023-47075 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 29.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Deeper analysis
Adobe Illustrator versions 28.0 and earlier along with 27.9 and earlier contain a Use After Free vulnerability tracked as CVE-2023-47075 and CWE-416. The flaw carries a CVSS 3.1 score of 7.8 and can permit arbitrary code execution in the context of the current user when triggered.
An attacker can exploit the issue by supplying a malicious file that the victim must open. The attack requires no privileges and succeeds over a local vector once the user interacts with the crafted document, resulting in full control of the affected Illustrator process.
Adobe has published mitigation guidance in security advisory APSB23-68, available at https://helpx.adobe.com/security/products/illustrator/apsb23-68.html.
EPSS for the CVE rose sharply from a low baseline to a peak of 0.2167 on 2025-01-22 before receding to the current value of 0.0012, indicating a period of increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-51230
Vulnerability details
Adobe Illustrator versions 28.0 (and earlier) and 27.9 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in…
more
that a victim must open a malicious file.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.