CVE-2021-21104: adobe illustrator

Vulnerability summary

CVE-2021-21104 is a high (CVSS 9.3) vulnerability in adobe illustrator. EPSS estimates a 6.56% chance of exploitation in the next 30 days, higher than 93.7% of scored vulnerabilities.

Timeline

1. 08-09-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Adobe Illustrator version 25.2 (and earlier) is affected by a memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

• CWE-788Access of Memory Location After End of BufferThe product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.