CVE-2025-27167 Overview
CVE-2025-27167 is an Untrusted Search Path vulnerability affecting Adobe Illustrator versions 29.2.1, 28.7.4, and earlier on Windows and macOS. The flaw allows a local attacker to execute arbitrary code in the context of the current user by placing a malicious resource along a path that Illustrator searches when loading critical components. Successful exploitation requires user interaction, typically launching the application from a directory containing the attacker-controlled file. Adobe published the issue in advisory APSB25-17 and assigned CWE-426: Untrusted Search Path.
Critical Impact
Local attackers can achieve arbitrary code execution, unauthorized file access, and configuration modification in the security context of the user running Adobe Illustrator.
Affected Products
- Adobe Illustrator 2024 versions 28.7.4 and earlier
- Adobe Illustrator 2025 versions 29.2.1 and earlier
- Microsoft Windows and Apple macOS installations of the affected versions
Discovery Timeline
- 2025-03-11 - CVE-2025-27167 published to the National Vulnerability Database
- 2025-03-11 - Adobe released Security Bulletin APSB25-17
- 2025-03-31 - Last updated in NVD database
Technical Details for CVE-2025-27167
Vulnerability Analysis
The vulnerability is classified under CWE-426: Untrusted Search Path. Adobe Illustrator resolves certain libraries, executables, or configuration resources using a search path that includes directories an attacker can influence. When the application starts or loads a component, it traverses this path and binds to the first matching resource it finds. An attacker who plants a malicious dynamic-link library (DLL), dylib, or executable in a higher-priority directory can hijack this resolution. Illustrator then loads the attacker's binary with the privileges of the user invoking the application.
Root Cause
The root cause is improper control over how Illustrator constructs and validates its search path for trusted resources. The application does not pin lookups to absolute, signed locations, allowing precedence to be given to writable directories such as the current working directory or per-user paths. This violates least-privilege loading principles for critical resources.
Attack Vector
Exploitation requires local access and user interaction. A typical attack chain involves delivering an Illustrator project file (.ai) bundled in a ZIP alongside a malicious DLL or dylib. When a victim extracts the archive and opens the project from that directory, Illustrator resolves a referenced library from the current working directory before reaching the trusted system location. The planted binary executes with the user's privileges, enabling persistence, credential theft, or pivoting to other resources on the host. Because Illustrator is commonly installed on creative workstations with access to shared storage, code execution on such endpoints provides useful staging for lateral movement.
Detection Methods for CVE-2025-27167
Indicators of Compromise
- Unsigned or unexpected DLL and dylib files in the same directory as Adobe Illustrator project files (.ai, .ait)
- Adobe Illustrator (Illustrator.exe or Adobe Illustrator.app) loading modules from user-writable paths such as Downloads, Desktop, or temporary extraction folders
- Child processes spawned by Illustrator that do not match the standard Creative Cloud process tree
Detection Strategies
- Monitor process image loads where Adobe Illustrator resolves a library from a non-standard, user-writable directory rather than the Adobe installation tree under Program Files or /Applications
- Alert on Adobe Illustrator spawning command interpreters such as cmd.exe, powershell.exe, bash, or osascript
- Hunt for archive extractions immediately followed by Illustrator launches from the same path, a common delivery pattern for search-path hijacks
Monitoring Recommendations
- Enable image-load and module-load telemetry from EDR sensors on systems with Adobe Illustrator installed
- Track file creation events for .dll, .dylib, and executable files in directories that also contain Illustrator document formats
- Correlate user opens of .ai files with subsequent unsigned module loads inside the Illustrator process
How to Mitigate CVE-2025-27167
Immediate Actions Required
- Update Adobe Illustrator to the fixed versions listed in Adobe Security Bulletin APSB25-17
- Inventory creative workstations using Adobe Creative Cloud and confirm Illustrator builds are above 29.2.1 and 28.7.4
- Instruct users to open Illustrator files only from trusted, controlled directories rather than archive extraction locations
Patch Information
Adobe addressed CVE-2025-27167 in the March 11, 2025 release. Customers should apply the patched versions of Adobe Illustrator 2024 and 2025 referenced in advisory APSB25-17 through Adobe Creative Cloud Desktop or enterprise deployment tooling. The advisory rates the update at Adobe Priority 3.
Workarounds
- Restrict the directories from which users can launch or open Illustrator documents, avoiding shared and download folders
- Apply application allowlisting policies that block unsigned DLL and dylib loads from user-writable paths within the Illustrator process
- Remove write permissions for standard users on any directory that resides on Illustrator's resource search path
# Windows: query installed Adobe Illustrator version to confirm patch level
wmic product where "Name like 'Adobe Illustrator%%'" get Name,Version
# macOS: confirm installed Illustrator build
mdls -name kMDItemVersion "/Applications/Adobe Illustrator 2025/Adobe Illustrator.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
