CVE-2020-9573: 
Adobe Illustrator vulnerability analysis and mitigation

Adobe Illustrator versions 24.0.2 and earlier were found to contain a memory corruption vulnerability identified as CVE-2020-9573. The vulnerability was discovered in January 2020 and publicly disclosed on April 28, 2020, when Adobe released security patches (Fortinet Blog, Adobe Security).

The vulnerability exists in the decoding of PCT files within Adobe Illustrator's 'MPS' plugin. Specifically, the vulnerability is caused by a malformed PCT file, which triggers an Out of Bounds memory access due to improper bounds checking. This can lead to unintended reads, writes, or frees in memory, potentially resulting in code corruption, control-flow hijack, or information leak attacks (Fortinet Blog).

Successful exploitation of this vulnerability could lead to arbitrary code execution within the context of the application. An attacker could potentially execute malicious code by using a specially crafted PCT file (CVE Mitre, Fortinet Blog).

The vulnerability can be exploited remotely through a specially crafted PCT file. Fortinet released an IPS signature named Adobe.Illustrator.CVE-2020-9573.Memory.Corruption to protect customers before the patch became available (Fortinet Blog).

Adobe released security patches to address this vulnerability on April 28, 2020. Users of Adobe Illustrator versions 24.0.2 and earlier are strongly encouraged to apply these patches as soon as possible. FortiGate IPS customers received updated IPS signatures for protection (Fortinet Blog, Adobe Security).