Security readout for executives and security teams
Plain-English summary
CVE-2022-30667 is a memory disclosure flaw in Adobe Illustrator. A successful attack requires a user to open a malicious file. The main business concern is exposure of sensitive process memory and weakening of defenses such as ASLR, not direct system takeover from the evidence provided.
Executive priority
Treat this as a moderate-priority endpoint patching issue. It is not described as remotely exploitable without user action, but it affects confidentiality and can weaken exploit mitigations, making it more important on workstations handling external creative files.
Technical view
Adobe Illustrator 26.0.2 and earlier, and 25.4.5 and earlier, contain a CWE-125 out-of-bounds read. The CVSS 3.1 score is 5.5 with local attack vector, no privileges required, required user interaction, high confidentiality impact, and no integrity or availability impact.
Likely exposure
Exposure is likely limited to endpoints where vulnerable Adobe Illustrator versions are installed and users may open untrusted Illustrator files. Organizations with design, marketing, publishing, or agency workflows should prioritize inventorying those systems.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. Exploitation requires user interaction: the victim must open a malicious file. The stated impact is sensitive memory disclosure and possible mitigation bypass such as ASLR.
Researcher notes
Evidence supports CWE-125 out-of-bounds read with confidentiality impact only. The source bundle does not provide exploit details, indicators of compromise, or named fixed versions beyond Adobe advisory direction. Avoid assuming active exploitation without additional cited evidence.
Mitigation direction
- Update Adobe Illustrator according to Adobe APSB22-26 guidance.
- Restrict opening Illustrator files from untrusted sources until systems are updated.
- Prioritize patching design and marketing workstations with external file intake.
- Use endpoint and email controls to flag suspicious Illustrator attachments.
Validation and detection
- Inventory installed Adobe Illustrator versions across managed endpoints.
- Identify installs at 26.0.2 or earlier and 25.4.5 or earlier.
- Confirm Adobe APSB22-26 remediation guidance has been applied.
- Review security telemetry for suspicious Illustrator file-open events.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-30667 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/illustrator/apsb22-26.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.