CVE-2025-21157
Published: 11 February 2025
Description
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Security Summary
CVE-2025-21157 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.0, ID19.5.1, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-02-11.
Exploitation requires local access and user interaction, specifically tricking a victim into opening a malicious file within the affected InDesign versions. No privileges are needed (PR:N), and the attack has low complexity (AC:L). Successful exploitation allows an attacker to achieve high-impact confidentiality, integrity, and availability violations, executing arbitrary code with the privileges of the current user.
Adobe's security bulletin APSB25-01, available at https://helpx.adobe.com/security/products/indesign/apsb25-01.html, details mitigation steps, including available patches for supported InDesign versions.
Details
- CWE(s)