Cyber Posture

CVE-2025-27177

High

Published: 11 March 2025

Published
11 March 2025
Modified
14 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0013 31.8th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

**CVE-2025-27177** is a Heap-based Buffer Overflow vulnerability (CWE-122, CWE-787) affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. Published on 2025-03-11, it has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and enables arbitrary code execution in the context of the current user upon opening a malicious file.

Exploitation requires local access and user interaction, where an attacker with a specially crafted file can convince a victim to open it in vulnerable InDesign versions. Successful exploitation leads to arbitrary code execution, potentially allowing full compromise of the user's system with high impacts on confidentiality, integrity, and availability.

Adobe Security Bulletin APSB25-19 (https://helpx.adobe.com/security/products/indesign/apsb25-19.html) confirms the vulnerability and states that InDesign Desktop versions ID20.2 and ID19.5.3 resolve it. Mitigation involves applying these patches immediately, as no workarounds are provided; user interaction is required for exploitation.

Details

CWE(s)
CWE-122CWE-787

Affected Products

adobe
indesign
≤ 19.5.3 · 20.0 — 20.2

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap-based buffer overflow enables arbitrary code execution upon opening a malicious InDesign file, directly mapping to client-side exploitation (T1203) and user execution of malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References