CVE-2026-71441

MediumCVSS 5.5/10Last modified Sep 8, 2026

Description

Illustrator is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Adobe	Illustrator Desktop 2026	<= 30.6
Adobe	Illustrator Desktop 2025	<= 29.8.9

References

https://helpx.adobe.com/security/products/illustrator/apsb26-124.htmlVendor Advisory

Timeline

Published: Aug 25, 2026
Last modified: Sep 8, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-714427.5CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of CVE-2026-714437.5CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An CVE-2026-714446.2CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of CVE-2026-714458.2AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processin CVE-2026-714466.9AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the CVE-2026-714476.9AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. T CVE-2026-714485.6: Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affec CVE-2026-714499.3: Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue a CVE-2026-71455.4A weakness has been identified in mettle sendportal up to 3.0.1. Affected is the function destroy of the file app/Http/Controllers/Workspace CVE-2026-714508.7Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authe CVE-2026-714515.6- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0 CVE-2026-714527.2- OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.