Cyber Posture

CVE-2025-27169

High

Published: 11 March 2025

Published
11 March 2025
Modified
28 April 2025
KEV Added
—
Patch
—
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0008 23.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27169 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Illustrator versions 29.2.1, 28.7.4, and earlier. Published on 2025-03-11T18:15:35.077, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and could result in arbitrary code execution in the context of the current user.

Exploitation requires user interaction, as a victim must open a malicious file. An attacker needs only local access with no privileges and can leverage the low-complexity attack to achieve high impacts on confidentiality, integrity, and availability within the unchanged security scope.

Adobe's security advisory APSB25-17 at https://helpx.adobe.com/security/products/illustrator/apsb25-17.html provides details on mitigation and available patches.

Details

CWE(s)
CWE-787

Affected Products

adobe
illustrator
28.0 — 28.7.5 · 29.0 — 29.3

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

Out-of-bounds write enables arbitrary code execution via malicious file opened by user, directly mapping to client-side exploitation (T1203) and user execution with malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References