CVE-2026-48275 describes an Untrusted Search Path vulnerability in Adobe Illustrator Desktop 2026. This vulnerability could enable an attacker to execute arbitrary code in the context of the current user if the user opens a crafted malicious file. The vulnerability affects the search path used by the application, potentially allowing execution of unintended binaries. The CVSS 3.1 base score is 8.6, reflecting high impact on confidentiality, integrity, and availability, with attack vector local, low attack complexity, no privileges required, user interaction required, and scope changed. No vendor advisory or patch information is available at this time.

Successful exploitation can lead to arbitrary code execution with full control in the context of the current user, compromising confidentiality, integrity, and availability of the affected system. The attack requires user interaction, specifically opening a malicious file, which limits remote exploitation but still poses a significant risk to users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources. No official remediation or temporary fixes have been published by Adobe at this time.