CVE-2024-34138: 
Adobe Illustrator vulnerability analysis and mitigation

A NULL Pointer Dereference vulnerability (CVE-2024-34138) was discovered in Adobe Illustrator versions 28.5, 27.9.4 and earlier. The vulnerability was disclosed on August 14, 2024, affecting both Windows and macOS operating systems (Adobe Advisory, NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) with a CVSS v3.1 base score of 5.5 (Medium). The attack vector is local (AV:L) with low attack complexity (AC:L), requires no privileges (PR:N), and needs user interaction (UI:R). The scope is unchanged (S:U) with no impact on confidentiality (C:N) or integrity (I:N), but high impact on availability (A:H) (Adobe Advisory).

If successfully exploited, this vulnerability could lead to an application denial-of-service (DoS) condition. The primary impact is on the availability of the application, where an attacker could cause Adobe Illustrator to crash (NVD).

Exploitation of this vulnerability requires user interaction, specifically that a victim must open a malicious file. There are currently no reports of this vulnerability being exploited in the wild (CIS Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest versions of Adobe Illustrator: beyond version 27.9.4 for the 2023 release and beyond version 28.5 for the 2024 release (Adobe Advisory).