CVE-2026-75991 Overview
CVE-2026-75991 is an Improper Input Validation vulnerability [CWE-20] in Adobe Illustrator that enables arbitrary code execution in the context of the current user. Exploitation requires a victim to open a malicious file crafted by the attacker. The vulnerability has a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. Adobe addressed the issue in security bulletin APSB26-131.
Critical Impact
An attacker who convinces a user to open a malicious Illustrator file can execute arbitrary code with the privileges of the current user, potentially leading to full user-context compromise.
Affected Products
- Adobe Illustrator (versions listed in Adobe security bulletin APSB26-131)
- Refer to the Adobe Illustrator Security Patch APSB26-131 advisory for the complete list of affected versions and platforms
Discovery Timeline
- 2026-09-08 - CVE-2026-75991 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75991
Vulnerability Analysis
CVE-2026-75991 is classified as an Improper Input Validation weakness [CWE-20] within Adobe Illustrator. The application fails to validate data supplied through a crafted file before processing it, allowing attacker-controlled input to influence execution flow. Successful exploitation results in arbitrary code execution under the current user's security context.
The issue carries a changed scope indicator, meaning the vulnerable component and the impacted component are not the same. This suggests that exploitation can affect resources managed outside the immediate Illustrator process boundary. Attack complexity is low, but exploitation requires user interaction through opening a malicious file.
At the time of publication, there is no public proof-of-concept, no known exploitation in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. EPSS data indicates a low near-term exploitation probability.
Root Cause
The root cause is improper validation of input parsed from a file consumed by Illustrator. When the application processes a malformed or specially crafted file, unchecked input reaches code paths that make assumptions about data structure, type, or bounds. This allows an attacker to trigger unintended behavior culminating in arbitrary code execution.
Attack Vector
The attack vector is local and requires user interaction. An attacker must deliver a malicious file, typically through phishing, watering-hole delivery, or shared file repositories, and convince the user to open it in Adobe Illustrator. Once opened, the malformed content triggers the vulnerable code path and executes attacker-controlled code with the user's privileges.
No verified public exploit code is available. Refer to the Adobe Illustrator Security Patch APSB26-131 advisory for vendor-provided technical context.
Detection Methods for CVE-2026-75991
Indicators of Compromise
- Adobe Illustrator processes (Illustrator.exe on Windows, Adobe Illustrator on macOS) spawning unexpected child processes such as command interpreters, scripting engines, or network utilities
- Illustrator processes making outbound network connections shortly after opening a file received from an external source
- Unexpected file writes to user-writable directories or persistence locations immediately following the opening of an .ai, .eps, or related Illustrator-compatible file
Detection Strategies
- Monitor for anomalous process lineage where Illustrator is the parent of shells, powershell.exe, wscript.exe, cmd.exe, bash, or osascript
- Correlate email or download telemetry with subsequent Illustrator file-open events to identify suspicious delivery chains
- Baseline normal Illustrator behavior in the environment and alert on deviations such as new module loads, unusual DLL injections, or unexpected memory allocations
Monitoring Recommendations
- Enable endpoint telemetry that captures process creation, image loads, and file writes originating from Adobe Illustrator
- Ingest EDR telemetry into a central data lake to enable retrospective hunting once additional indicators for CVE-2026-75991 emerge
- Track patch deployment status of Adobe Illustrator across managed endpoints to identify unpatched systems at risk
How to Mitigate CVE-2026-75991
Immediate Actions Required
- Apply the fixed Illustrator version documented in Adobe Illustrator Security Patch APSB26-131 to all managed workstations
- Instruct users to avoid opening Illustrator files received from untrusted sources or unexpected senders until patching completes
- Prioritize patching for users who routinely handle externally sourced design assets
Patch Information
Adobe released a fix for CVE-2026-75991 in security bulletin APSB26-131. Administrators should consult the Adobe Illustrator Security Patch APSB26-131 advisory for the specific fixed versions and update instructions across supported platforms. Use Adobe Creative Cloud Desktop or enterprise deployment tooling to distribute the update.
Workarounds
- Restrict opening of Illustrator files to those originating from trusted internal repositories until patches are deployed
- Apply application allowlisting or attack surface reduction rules to block Illustrator from spawning script interpreters and shells
- Use email and web gateways to inspect and quarantine Illustrator-compatible file types delivered from external sources
# Verify installed Adobe Illustrator version on Windows
reg query "HKLM\SOFTWARE\Adobe\Illustrator" /s /v Version
# Verify installed Adobe Illustrator version on macOS
defaults read "/Applications/Adobe Illustrator 2026/Adobe Illustrator.app/Contents/Info.plist" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
