CVE-2025-49567: Adobe Illustrator DOS Vulnerability

CVE-2025-49567 Overview

CVE-2025-49567 is a NULL Pointer Dereference vulnerability [CWE-476] affecting Adobe Illustrator versions 28.7.8, 29.6.1, and earlier on both Windows and macOS. An attacker can craft a malicious file that, when opened by a victim in Illustrator, dereferences a null pointer and crashes the application. The result is a local denial-of-service condition affecting availability. Exploitation requires user interaction — specifically, the victim must open the malicious file. There is no impact to confidentiality or integrity, and no known public exploit or in-the-wild activity has been reported.

Critical Impact
A malicious file opened in Adobe Illustrator can crash the application, disrupting design workflows and causing loss of unsaved work.

Affected Products

Adobe Illustrator 28.7.8 and earlier
Adobe Illustrator 29.6.1 and earlier
Runs on Microsoft Windows and Apple macOS

Discovery Timeline

2025-08-12 - CVE-2025-49567 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49567

Vulnerability Analysis

The flaw is a NULL Pointer Dereference [CWE-476] triggered during the parsing of a specially crafted file in Adobe Illustrator. When the application processes the malformed input, code paths that assume a valid object reference operate on a pointer that has not been initialized or has been set to null. Dereferencing that pointer terminates the process. The vulnerability is local in nature: an attacker cannot deliver the exploit over the network. It requires the victim to open the attacker-supplied file within Illustrator on Windows or macOS. Impact is limited to application availability — the process crashes, but confidentiality and integrity are not affected.

Root Cause

The root cause is missing validation of a pointer value returned during file parsing. Adobe's advisory APSB25-74 categorizes the defect under CWE-476: NULL Pointer Dereference. A structured field within the malicious document produces an unexpected state where a required object is absent, and the subsequent code path does not check for null before use.

Attack Vector

The attack vector is local and file-based. An attacker distributes a malicious Illustrator-compatible file through email attachments, shared drives, cloud storage links, or a compromised website. When the victim opens the file in a vulnerable Illustrator build, the parser triggers the null dereference and Illustrator crashes. There is no privilege escalation or code execution primitive documented for this issue — impact is confined to denial of service.

No public proof-of-concept or exploit code has been released. For technical details, see the Adobe Illustrator Security Bulletin APSB25-74.

Detection Methods for CVE-2025-49567

Indicators of Compromise

Repeated Illustrator.exe (Windows) or Adobe Illustrator (macOS) process crashes correlated with opening third-party .ai, .eps, .pdf, or .svg files
Windows Application Event Log entries containing Faulting application name: Illustrator.exe with an access violation exception (0xC0000005)
macOS crash reports under ~/Library/Logs/DiganosticReports/ referencing Illustrator with EXC_BAD_ACCESS (SIGSEGV) and a null address
Unexpected Illustrator files received from untrusted senders or downloaded from unverified sources

Detection Strategies

Deploy endpoint detection and response (EDR) rules that alert on abnormal Illustrator.exe termination events, especially when the parent process is a mail client, browser, or archiver
Correlate file-open telemetry with process-crash events to identify a malicious file being distributed across multiple hosts
Inventory Illustrator installations across the fleet and flag hosts running versions at or below 28.7.8 and 29.6.1

Monitoring Recommendations

Forward Windows Application and macOS unified logs to a centralized data lake for crash-event correlation
Track user-reported Illustrator crashes through the helpdesk and cross-reference against file sources
Monitor perimeter and email gateways for unusual volumes of Illustrator-format attachments from external senders

How to Mitigate CVE-2025-49567

Immediate Actions Required

Upgrade Adobe Illustrator to the fixed release identified in Adobe Security Bulletin APSB25-74
Instruct users not to open Illustrator files received from untrusted sources or unexpected senders
Confirm Adobe Creative Cloud auto-update is enabled on managed endpoints to receive future security releases

Patch Information

Adobe addressed CVE-2025-49567 in the security update documented in bulletin APSB25-74. Administrators should push the update through Adobe Creative Cloud Desktop, the Adobe Admin Console, or their standard software distribution tooling and verify the installed version on each endpoint after deployment.

Workarounds

Restrict opening of Illustrator files to those originating from trusted internal sources until patching is complete
Use an isolated or sandboxed workstation to triage suspicious design files
Apply email gateway policies to quarantine Illustrator-format attachments from external, unverified senders

bash

# Verify installed Adobe Illustrator version

# Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Illustrator*" } |
  Select-Object DisplayName, DisplayVersion

# macOS (Terminal)
defaults read "/Applications/Adobe Illustrator 2025/Adobe Illustrator.app/Contents/Info.plist" CFBundleShortVersionString