PT-2021-21099 · Adobe · Illustrator

Mat Powell · Published 2021-08-20 · Updated 2022-10-07 · CVE-2021-36009

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Adobe Illustrator versions 25.2.3 and earlier

Description: The issue is related to a memory corruption vulnerability that occurs when parsing a specially crafted file. This can allow an unauthenticated attacker to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically that a victim must open a malicious file.

Recommendations: For Adobe Illustrator versions 25.2.3 and earlier, update to a version later than 25.2.3 to resolve the issue. As a temporary workaround, consider avoiding the opening of files from untrusted sources to minimize the risk of exploitation.

Fix

Memory Corruption

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-787

CWE-788

Related Identifiers

CVE-2021-36009

ZDI-21-1147

Affected Products

Illustrator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-36009 · Security Note
• https://helpx.adobe.com/security/products/illustrator/apsb21-42.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-1147 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36009 · Vendor Advisory
• https://t.me/cvenotify/23096 · Telegram Post