CVE-2026-27272
Published: 10 March 2026
Summary
CVE-2026-27272 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27272 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Illustrator versions 29.8.4, 30.1, and earlier. Published on 2026-03-10, this flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) indicates that an attacker needs local access with low attack complexity and no privileges, but relies on tricking the user into opening the file to achieve high impacts on confidentiality, integrity, and availability.
Adobe's security bulletin APSB26-18, available at https://helpx.adobe.com/security/products/illustrator/apsb26-18.html, provides details on the vulnerability and associated mitigation or patch information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-10951
Vulnerability details
Illustrator versions 29.8.4, 30.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables arbitrary code execution via malicious file opened by user (T1203 Exploitation for Client Execution + T1204.002 Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates timely identification, reporting, and patching of flaws like the out-of-bounds write in Adobe Illustrator, directly preventing exploitation of CVE-2026-27272.
RA-5 requires vulnerability scanning to detect vulnerable versions of Adobe Illustrator affected by CVE-2026-27272, enabling remediation.
SI-16 implements memory protections such as ASLR and DEP to mitigate arbitrary code execution resulting from the out-of-bounds write vulnerability.