CVE-2026-21362
Published: 10 March 2026
Summary
CVE-2026-21362 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21362 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Illustrator versions 29.8.4, 30.1, and earlier. Published on 2026-03-10T23:16:43.577, the flaw exists in the Illustrator software and could result in arbitrary code execution in the context of the current user. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
The vulnerability can be exploited by an attacker with local access who tricks a victim into opening a malicious file, requiring user interaction. No privileges are needed (PR:N), and the attack has low complexity (AC:L). Successful exploitation enables high-impact effects on confidentiality, integrity, and availability in the user's context, with unchanged scope (S:U).
Adobe's security advisory APSB26-18, available at https://helpx.adobe.com/security/products/illustrator/apsb26-18.html, provides further details on the issue. Security practitioners should consult this bulletin for recommended mitigations and patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10942
Vulnerability details
Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables arbitrary code execution via malicious file opened by user (T1204.002); directly matches client-side exploitation technique (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the out-of-bounds write vulnerability by requiring timely remediation through vendor patches for affected Adobe Illustrator versions.
Implements memory safeguards such as DEP and ASLR that prevent arbitrary code execution from out-of-bounds write exploits in the Illustrator process.
Malicious code protection scans and blocks malicious files targeting the vulnerability before they can be opened in Illustrator.