CVE-2021-36009: Adobe Illustrator PDF File Parsing Memory Corruption Remote Code Execution Vulnerability
Adobe Illustrator version 25.2.3 (and earlier) is affected by an memory corruption vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Illustrator. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. An attacker can leverage this vulnerability to execute code in the context of the current process.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36009?
CVE-2021-36009 has been classified with a high severity due to its potential for arbitrary code execution.
How do I fix CVE-2021-36009?
To fix CVE-2021-36009, Adobe recommends updating to the latest version of Adobe Illustrator.
Who is affected by CVE-2021-36009?
CVE-2021-36009 affects users running Adobe Illustrator versions 25.2.3 and earlier.
What type of attack can exploit CVE-2021-36009?
An unauthenticated attacker could exploit CVE-2021-36009 through specially crafted files to execute arbitrary code.
Is there a workaround for CVE-2021-36009?
Currently, there are no known workarounds for CVE-2021-36009; the recommended mitigation is to apply the available updates.