Adobe Illustrator Desktop 2026 contains an Incorrect Authorization vulnerability (CWE-863) that may lead to arbitrary code execution in the context of the current user. The vulnerability requires a victim to open a malicious file to be exploited. The security scope is changed, indicating that the impact extends beyond the initial component. The CVSS 3.1 base score is 8.6, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been disclosed yet, and no known exploits are reported in the wild.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. The requirement for user interaction (opening a malicious file) limits the attack vector to social engineering or targeted delivery methods.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when opening files from untrusted sources and follow general best practices for handling suspicious files.