Cyber Posture

CVE-2025-27168

High

Published: 11 March 2025

Published
11 March 2025
Modified
31 March 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0007 21.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27168 is a stack-based buffer overflow vulnerability (CWE-121, CWE-787) affecting Adobe Illustrator versions 29.2.1, 28.7.4, and earlier. The flaw occurs during file processing and can lead to arbitrary code execution in the context of the current user. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H), indicating high confidentiality, integrity, and availability impacts upon successful exploitation.

An attacker with local access to the victim's system can exploit this vulnerability by tricking the user into opening a specially crafted malicious file. No special privileges are required (PR:N), and the attack has low complexity (AC:L), but it depends on user interaction (UI:R) such as opening the file in Illustrator. Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially enabling full system compromise if the user has elevated permissions.

Adobe's security bulletin APSB25-17, available at https://helpx.adobe.com/security/products/illustrator/apsb25-17.html, provides details on the vulnerability and recommends mitigation steps, including applying the latest security updates to affected Illustrator versions.

Details

CWE(s)
CWE-121CWE-787

Affected Products

adobe
illustrator
28.0 — 28.7.5 · 29.0 — 29.3

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Stack-based buffer overflow in file processing enables arbitrary code execution upon opening a malicious file, directly mapping to client-side exploitation (T1203) and user execution of malicious files (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References