Cyber Posture

CVE-2025-27167

High

Published: 11 March 2025

Published
11 March 2025
Modified
31 March 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0007 22.2th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.

Security Summary

CVE-2025-27167 is an Untrusted Search Path vulnerability (CWE-426) affecting Adobe Illustrator versions 29.2.1, 28.7.4, and earlier. The flaw arises when the application relies on a search path to locate critical resources such as programs, allowing an attacker to manipulate that path to redirect to malicious programs or resources. This could enable execution of arbitrary code, unauthorized access to data files, or unintended modification of configurations, as the application trusts these resources without sufficient validation.

The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating local access is required with low attack complexity, no privileges needed, but user interaction is necessary. A local attacker could exploit it by modifying the search path—such as through environment variables or directory placement—to trick Illustrator into loading and executing malicious programs or accessing sensitive data, potentially leading to high-impact confidentiality, integrity, and availability compromises on the affected system.

Adobe's security bulletin APSB25-17, available at https://helpx.adobe.com/security/products/illustrator/apsb25-17.html, provides details on the vulnerability and recommended mitigations, including available patches for affected Illustrator versions. Security practitioners should prioritize updating to patched versions to address this issue.

Details

CWE(s)
CWE-426

Affected Products

adobe
illustrator
28.0 — 28.7.5 · 29.0 — 29.3

MITRE ATT&CK Enterprise Techniques

T1574.008 Path Interception by Search Order Hijacking Stealth
Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.
Why these techniques?

The untrusted search path vulnerability (CWE-426) directly enables an attacker to manipulate the application's resource search path (e.g., via environment variables or directory placement) to load and execute malicious programs, mapping to Path Interception by Search Order Hijacking.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References