CVE-2025-24452
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-24452 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high impact. Exploitation requires local access and user interaction, where an attacker with no privileges tricks a victim into opening a specially crafted file in InDesign. Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially enabling full system compromise on the affected machine.
Adobe Security Bulletin APSB25-19, available at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, provides details on the vulnerability and mitigation steps, including available patches for affected versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an out-of-bounds write in Adobe InDesign leading to arbitrary code execution when a user opens a malicious file, directly mapping to exploitation for client execution (T1203) and user execution via malicious file (T1204.002).