CVE-2026-34618
Published: 14 April 2026
Summary
CVE-2026-34618 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation and patching of known flaws like this out-of-bounds write vulnerability in Adobe Illustrator to prevent arbitrary code execution.
Enables vulnerability scanning to identify systems running vulnerable versions of Adobe Illustrator affected by CVE-2026-34618.
Mandates monitoring of security advisories such as Adobe's APSB26-42 to promptly address this vulnerability through patching.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability requires a user to open a malicious file to trigger the out-of-bounds write leading to arbitrary code execution, directly mapping to T1204.002 Malicious File.
NVD Description
Illustrator versions 30.2, 29.8.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
Deeper analysisAI
CVE-2026-34618 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Illustrator versions 30.2, 29.8.5, and earlier. Published on 2026-04-14T20:16:47.523, the issue carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H) and could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. An attacker with local access can deliver such a file, potentially tricking the user into opening it, to achieve arbitrary code execution with the privileges of the affected user's session.
Adobe's security bulletin APSB26-42, available at https://helpx.adobe.com/security/products/illustrator/apsb26-42.html, details the vulnerability and provides information on patches and mitigation steps.
Details
- CWE(s)