CVE-2020-24414: 
Adobe Illustrator vulnerability analysis and mitigation

Adobe Illustrator version 24.1.2 and earlier versions contain a memory corruption vulnerability (CVE-2020-24414) that occurs when parsing specially crafted .svg files. The vulnerability was discovered by Honggang Ren of Fortinet's FortiGuard Labs and was publicly disclosed on October 20, 2020 (Fortinet Blog, NVD).

The vulnerability is specifically caused by a malformed SVG file that triggers an Out of Bounds memory access due to an improper bounds check in the SVGRE.dll library. It has been assigned a CVSS v3.1 base score of 7.8 (High), with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-787 (Out-of-bounds Write) and CWE-788 (Access of Memory Location After End of Buffer) (NVD).

If successfully exploited, this vulnerability could result in arbitrary code execution in the context of the current user. The vulnerability requires user interaction to exploit, typically through opening a specially crafted SVG file (Fortinet Blog).

The vulnerability requires local access and user interaction to exploit. Fortinet released an IPS signature named Adobe.Illustrator.CVE-2020-24414.Memory.Corruption to protect their customers before the patch became available (Fortinet Blog).

Adobe has released security patches to address this vulnerability. Users are strongly encouraged to update to the latest version of Adobe Illustrator. Additionally, Fortinet customers with IPS services have proactive protection through the released signature (Fortinet Blog).