CVE-2025-21121
Published: 11 February 2025
Description
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Summary
CVE-2025-21121 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions 20.0, 19.5.1, and earlier. Published on 2025-02-11, the flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. Local attackers with no privileges (PR:N) can craft and deliver such a file, triggering the vulnerability with low attack complexity (AC:L). Successful exploitation yields high impacts on confidentiality, integrity, and availability, earning a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
Adobe's security bulletin APSB25-01 addresses this issue; refer to https://helpx.adobe.com/security/products/indesign/apsb25-01.html for details on patches and mitigation.
Details
- CWE(s)