Cyber Posture

CVE-2025-27178

High

Published: 11 March 2025

Published
11 March 2025
Modified
14 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0010 28.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

An adversary may rely upon a user opening a malicious file in order to gain execution.

Security Summary

CVE-2025-27178 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. This flaw could lead to arbitrary code execution in the context of the current user. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H), indicating high severity due to its potential for significant impact on confidentiality, integrity, and availability.

Exploitation requires user interaction, specifically opening a malicious file in the affected InDesign versions. An attacker with local access can craft such a file to trigger the out-of-bounds write, resulting in code execution as the logged-in user without requiring privileges. No elevated permissions are needed, and the attack complexity is low, making it feasible for adversaries targeting InDesign users via socially engineered file delivery, such as email attachments or shared documents.

Adobe Security Bulletin APSB25-19 provides details on mitigation, available at https://helpx.adobe.com/security/products/indesign/apsb25-19.html. Security practitioners should consult this advisory for patch information and apply updates to vulnerable InDesign installations promptly.

Details

CWE(s)
CWE-787

Affected Products

adobe
indesign
≤ 19.5.3 · 20.0 — 20.2

MITRE ATT&CK Enterprise Techniques

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

The out-of-bounds write enables arbitrary code execution when a user opens a malicious InDesign file, directly mapping to exploitation for client execution and user execution via malicious file.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References