CVE-2020-24412: 
Adobe Illustrator vulnerability analysis and mitigation

Adobe Illustrator version 24.1.2 and earlier versions contain a memory corruption vulnerability (CVE-2020-24412) that was discovered and disclosed on October 20, 2020. The vulnerability affects the SVG file parsing functionality within the SVGRE.dll library. This security flaw was discovered by Honggang Ren of Fortinet's FortiGuard Labs (Fortinet Blog, Adobe Advisory).

The vulnerability is classified as a memory corruption issue that occurs specifically in the SVGRE.dll library when parsing specially crafted SVG files. It is caused by an Out of Bounds memory access due to an improper bounds check. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness has been categorized as CWE-787 (Out-of-bounds Write) and CWE-788 (Access of Memory Location After End of Buffer) (NVD).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. The attacker could potentially gain the same rights and privileges as the compromised user, potentially leading to unauthorized access and system compromise (Fortinet Blog).

The vulnerability requires user interaction to exploit, specifically through the processing of a specially crafted SVG file. A remote attacker may be able to exploit this vulnerability to execute arbitrary code within the context of the application via a crafted SVG file (Fortinet Blog).

Adobe has released security patches to address this vulnerability. Users are strongly encouraged to update to the latest version of Adobe Illustrator. Additionally, Fortinet has released an IPS signature named Adobe.Illustrator.CVE-2020-24412.Memory.Corruption to protect their customers before the patch became available (Fortinet Blog, Adobe Advisory).