CVE-2025-27166
Published: 11 March 2025
Description
An adversary may rely upon a user opening a malicious file in order to gain execution.
Security Summary
CVE-2025-27166 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions 20.1, 19.5.2, and earlier. The flaw resides in the software's handling of files, potentially leading to arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. Per the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), an attacker needs local access with low attack complexity and no privileges, but must convince the user to open the file. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability in the user's context.
Adobe's security bulletin APSB25-19, published at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, details patches and mitigation guidance for affected versions.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Out-of-bounds write in Adobe InDesign enables arbitrary code execution via opening a malicious file, directly mapping to client-side exploitation (T1203) and user execution through malicious file (T1204.002).