CVE-2025-27167: Illustrator | Untrusted Search Path (CWE-426)
First published: Tue Mar 11 2025(Updated: )
Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Illustrator 2024 | <29.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-27167?
CVE-2025-27167 has a high severity rating due to the potential for attackers to execute unauthorized programs.
How do I fix CVE-2025-27167?
To fix CVE-2025-27167, update Adobe Illustrator to version 29.2.2 or later.
What versions of Adobe Illustrator are affected by CVE-2025-27167?
Adobe Illustrator versions 29.2.1, 28.7.4 and earlier are affected by CVE-2025-27167.
What is an Untrusted Search Path vulnerability in CVE-2025-27167?
An Untrusted Search Path vulnerability allows attackers to leverage alternative search paths to execute malicious programs.
What are the potential consequences of CVE-2025-27167?
The potential consequences include unauthorized access to data files, execution of malicious code, or unexpected modification of application configurations.
- agent/references
- agent/weakness
- agent/title
- agent/description
- agent/first-publish-date
- agent/type
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/severity
- agent/author
- agent/event
- agent/source
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/adobe
- canonical/adobe illustrator 2024