CVE-2025-21159: 
Adobe Illustrator vulnerability analysis and mitigation

Adobe Illustrator versions 29.1, 28.7.3 and earlier are affected by a Use After Free vulnerability (CVE-2025-21159) that was disclosed on February 11, 2025. This critical vulnerability could result in arbitrary code execution in the context of the current user, requiring user interaction through opening a malicious file (Adobe Security, NVD).

The vulnerability is classified as a Use After Free (CWE-416) issue with a CVSS v3.1 base score of 7.8 (High). The attack vector is local (AV:L), with low attack complexity (AC:L), requiring no privileges (PR:N) but needs user interaction (UI:R). The scope is unchanged (S:U), with high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H) (Adobe Security).

If successfully exploited, this vulnerability could lead to arbitrary code execution in the context of the current user. This means an attacker could potentially execute malicious code with the same privileges as the user running Adobe Illustrator (Adobe Security).

Adobe has released security updates to address this vulnerability. Users are recommended to update their installations to Illustrator 2025 version 29.2.1 and above, or Illustrator 2024 version 28.7.4 and above. The update can be installed via the Creative Cloud desktop app's update mechanism (Adobe Security).

The vulnerability was discovered and reported by security researcher Francis Provencher (prl) through Adobe's public bug bounty program with HackerOne (Adobe Security).