CVE-2024-43758 Overview
CVE-2024-43758 is a Use After Free vulnerability [CWE-416] affecting Adobe Illustrator versions 28.6, 27.9.5, and earlier releases on both Windows and macOS. Exploitation allows arbitrary code execution in the context of the current user. The attack requires local user interaction, meaning a victim must open a crafted malicious file for the flaw to trigger. Adobe published a security advisory and released fixed builds addressing this issue.
Critical Impact
Successful exploitation allows arbitrary code execution under the current user's privileges, enabling attackers to install malware, modify data, or pivot to further compromise on Windows and macOS workstations.
Affected Products
- Adobe Illustrator 28.6 and earlier (2024 release track)
- Adobe Illustrator 27.9.5 and earlier (2023 release track)
- Apple macOS and Microsoft Windows installations of the affected Illustrator versions
Discovery Timeline
- 2024-09-13 - CVE-2024-43758 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-43758
Vulnerability Analysis
CVE-2024-43758 is a Use After Free flaw [CWE-416] in Adobe Illustrator's file-parsing logic. A Use After Free occurs when a program continues to reference heap memory after it has been released. If an attacker controls allocations that reuse the freed region, the dangling pointer dereference can be steered toward attacker-controlled data. In Illustrator, this condition is reached during processing of a malformed document, giving the attacker a path to arbitrary code execution in the current user context.
Root Cause
The root cause is improper object lifetime management within Illustrator's document-parsing routines. Internal structures are freed while other code paths retain references to them. Subsequent operations on those stale references corrupt the heap or transfer control to attacker-influenced memory. See the Adobe Illustrator Security Advisory for vendor-provided details on the affected components.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a malicious Illustrator-compatible file (for example, an .ai or associated format) and delivers it through email, chat, a shared drive, or a drive-by download. When the victim opens the file in a vulnerable Illustrator build, the Use After Free triggers and executes attacker-supplied code with the privileges of the logged-in user. No authentication or network access to the target is required.
No public proof-of-concept exploit or entry in Exploit-DB has been observed for this CVE. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-43758
Indicators of Compromise
- Illustrator (Illustrator.exe on Windows, Adobe Illustrator on macOS) spawning shell interpreters such as cmd.exe, powershell.exe, bash, or zsh.
- Illustrator processes writing executable files, scripts, or scheduled task entries to disk shortly after opening a document.
- Unexpected outbound network connections initiated by the Illustrator process to unknown hosts.
- Crash dumps or Windows Error Reporting events referencing heap corruption in the Illustrator process.
Detection Strategies
- Hunt for parent-child process anomalies where Illustrator is the parent of interpreters, LOLBins, or persistence utilities.
- Alert on Illustrator loading unsigned or unusual DLLs and dynamic libraries from user-writable paths.
- Correlate file-open telemetry for .ai, .eps, .svg, and .pdf documents from untrusted sources with subsequent suspicious child activity.
Monitoring Recommendations
- Enable EDR file and process telemetry on all endpoints running Adobe Illustrator.
- Forward Illustrator crash and reliability events to a centralized SIEM for correlation with user activity.
- Track software inventory to identify hosts still running Illustrator versions at or below 28.6 or 27.9.5.
How to Mitigate CVE-2024-43758
Immediate Actions Required
- Upgrade Adobe Illustrator to the fixed versions listed in Adobe advisory APSB24-66 on all Windows and macOS endpoints.
- Inventory all systems running Illustrator and prioritize designers, marketing teams, and shared workstations for patching.
- Instruct users not to open Illustrator files received from untrusted or unverified sources until patching is complete.
Patch Information
Adobe has released fixed Illustrator builds that remediate CVE-2024-43758. Details, exact fixed version numbers, and download links are provided in the Adobe Illustrator Security Advisory (APSB24-66). Apply updates through Adobe Creative Cloud or the enterprise Admin Console.
Workarounds
- Block or quarantine Illustrator file types delivered via email gateways from external senders until endpoints are patched.
- Restrict standard user accounts from running Illustrator with elevated privileges to limit blast radius on successful exploitation.
- Enforce application allowlisting to prevent child processes spawned by Illustrator from executing arbitrary binaries.
# Verify installed Illustrator version on Windows
reg query "HKLM\SOFTWARE\Adobe\Illustrator" /s | findstr /i "Version"
# Verify installed Illustrator version on macOS
defaults read "/Applications/Adobe Illustrator 2024/Adobe Illustrator.app/Contents/Info.plist" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
