CVE-2024-20791: 
Adobe Illustrator vulnerability analysis and mitigation

CVE-2024-20791 is an out-of-bounds read vulnerability affecting Adobe Illustrator versions 28.4, 27.9.3 and earlier on both Windows and macOS platforms. The vulnerability was disclosed on May 16, 2024, and was discovered by security researcher Francis Provencher (prl) (Adobe Advisory).

The vulnerability is characterized as an out-of-bounds read issue that occurs when parsing a crafted file, which could result in a read past the end of an allocated memory structure. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness is classified as CWE-125 (Out-of-bounds Read) (NVD).

A successful exploitation of this vulnerability could allow an attacker to execute code in the context of the current user. The vulnerability affects confidentiality, integrity, and availability of the system, as indicated by the high impact scores in the CVSS rating (NVD).

Exploitation of this vulnerability requires user interaction, specifically requiring a victim to open a malicious file. The attack complexity is considered low, but requires local access to the system (NVD).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest versions of Adobe Illustrator: versions after 27.9.4 for the older branch, and versions after 28.5 for the newer branch (NVD).