CVE-2024-45114: Adobe Illustrator RCE Vulnerability

CVE-2024-45114 Overview

CVE-2024-45114 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Illustrator versions 28.7.1 and earlier on both Windows and macOS. Successful exploitation allows arbitrary code execution in the context of the current user. The vulnerability requires user interaction, as a victim must open a crafted malicious file in Illustrator. Adobe published guidance in security advisory APSB24-87 and released fixed builds. The issue carries a CVSS 3.1 base score of 7.8 under a local attack vector with low attack complexity.

Critical Impact
An attacker who convinces a user to open a malicious Illustrator file can execute arbitrary code with the user's privileges, enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Illustrator 28.7.1 and earlier
Apple macOS (all supported versions running affected Illustrator builds)
Microsoft Windows (all supported versions running affected Illustrator builds)

Discovery Timeline

2024-11-12 - CVE-2024-45114 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45114

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition in Adobe Illustrator's file parsing logic. When Illustrator processes a crafted document, the application writes data past the boundaries of an allocated buffer. This memory corruption can overwrite adjacent structures, function pointers, or control data used by the application.

An attacker crafts a malicious Illustrator-supported file and delivers it through phishing, file-sharing services, or watering-hole sites. Opening the file triggers the corrupted parsing path and hands execution control to attacker-supplied data. Because Illustrator runs with the privileges of the interactive user, executed payloads inherit those permissions.

Exploitation does not require authentication or network access, but it does require user interaction. The local attack vector reflects the requirement that the malicious file be processed on the target host.

Root Cause

The root cause is missing or insufficient bounds checking when Illustrator parses structured file content. The parser accepts attacker-controlled length or offset fields and uses them to index into a fixed-size buffer without validating the resulting write range. This behavior maps to [CWE-787: Out-of-bounds Write].

Attack Vector

The attack begins with social engineering. The attacker sends a malicious Illustrator file to the victim through email, chat, or a hosted download. When the victim opens the file, the parser reaches the vulnerable code path and writes attacker-controlled bytes outside the intended buffer. The resulting corruption is shaped to hijack control flow and execute a payload staged elsewhere in memory.

The vulnerability manifests during file parsing. See the Adobe Security Advisory APSB24-87 for vendor technical details.

Detection Methods for CVE-2024-45114

Indicators of Compromise

Adobe Illustrator (Illustrator.exe on Windows, Adobe Illustrator on macOS) crashing or spawning unexpected child processes such as cmd.exe, powershell.exe, or bash.
Illustrator process making outbound network connections to unfamiliar hosts shortly after opening a document.
Illustrator writing executable files, scripts, or scheduled task entries to user-writable directories.
Inbound .ai, .eps, .pdf, or .svg files from untrusted senders opened by users in design or marketing roles.

Detection Strategies

Monitor for process lineage anomalies where Illustrator is the parent of shell interpreters or LOLBins.
Alert on module loads or memory allocations with RWX permissions inside the Illustrator process.
Inspect crash telemetry (WER, macOS crash reports) for access violations in Illustrator's parsing modules.
Correlate email gateway logs of inbound Illustrator-compatible attachments with subsequent endpoint activity.

Monitoring Recommendations

Track installed Illustrator versions across the fleet and alert on any host running 28.7.1 or earlier.
Ingest endpoint process and file-write telemetry into a central data lake for retrospective hunts.
Baseline normal Illustrator network behavior so outbound connections from the process stand out.
Review user-opened file paths for documents sourced from downloads, temp folders, or removable media.

How to Mitigate CVE-2024-45114

Immediate Actions Required

Update Adobe Illustrator to the fixed version listed in APSB24-87 on every Windows and macOS host.
Block inbound Illustrator-compatible attachments from untrusted senders at the mail gateway.
Instruct designers and other Illustrator users to avoid opening files from unknown sources until patching is complete.
Enable application allowlisting to prevent Illustrator from launching non-approved child processes.

Patch Information

Adobe released fixed builds and documented the update in the Adobe Security Advisory APSB24-87. Apply the vendor-supplied update through the Adobe Creative Cloud desktop application or through managed software deployment tooling. Confirm the installed version is later than 28.7.1 after patching.

Workarounds

Restrict Illustrator to opening files only from vetted network shares or managed asset repositories.
Run Illustrator under a standard user account rather than a local administrator to limit payload impact.
Use Attack Surface Reduction rules on Windows to block Office and creative applications from spawning child processes.
Isolate hosts that handle externally sourced design files into a dedicated VLAN with restricted egress.

bash

# Verify installed Illustrator version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe Illustrator 2024/Adobe Illustrator.app"

# Verify installed Illustrator version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Illustrator*" } |
  Select-Object DisplayName, DisplayVersion