CVE-2025-27167: Illustrator | Untrusted Search Path (CWE-426)
Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Illustratorto a version that resolves this vulnerability.Fixed in 29.2.1 - Upgrade
Upgrade
Illustratorto a version that resolves this vulnerability.Fixed in 28.7.4 - Configuration
Ensure Illustrator does not use attacker-modifiable search paths to locate critical resources (e.g., programs, unauthorized data files, configuration files); configure it to use only trusted locations/absolute paths.
Illustrator Untrusted Search Path for critical resources = Use trusted, absolute paths and prevent attacker-controlled search path locations
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27167?
CVE-2025-27167 has a high severity rating due to the potential for attackers to execute unauthorized programs.
How do I fix CVE-2025-27167?
To fix CVE-2025-27167, update Adobe Illustrator to version 29.2.2 or later.
What versions of Adobe Illustrator are affected by CVE-2025-27167?
Adobe Illustrator versions 29.2.1, 28.7.4 and earlier are affected by CVE-2025-27167.
What is an Untrusted Search Path vulnerability in CVE-2025-27167?
An Untrusted Search Path vulnerability allows attackers to leverage alternative search paths to execute malicious programs.
What are the potential consequences of CVE-2025-27167?
The potential consequences include unauthorized access to data files, execution of malicious code, or unexpected modification of application configurations.