CVE-2025-21122
Published: 14 January 2025
Summary
CVE-2025-21122 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Adobe Photoshop. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 42.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-21122 is an Integer Underflow (Wrap or Wraparound) vulnerability, classified as CWE-191, affecting Adobe Photoshop Desktop versions 25.12, 26.1, and earlier. Published on 2025-01-14, this issue resides in the desktop application and could lead to arbitrary code execution in the context of the current user. The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
The attack requires local access with low attack complexity and no privileges, but user interaction is mandatory, specifically opening a malicious file. An attacker could exploit this by tricking a victim into processing a specially crafted file, such as via email attachments or shared documents. Successful exploitation enables arbitrary code execution with high impacts on confidentiality, integrity, and availability, running in the privileges of the logged-in user.
Adobe's security bulletin APSB25-02, detailed at https://helpx.adobe.com/security/products/photoshop/apsb25-02.html, addresses the vulnerability and outlines mitigations or patches for affected versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2229
Vulnerability details
Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…
more
a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer underflow in Photoshop enables RCE via opening a malicious crafted file (user interaction required).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-2 mandates identification, testing, and installation of software patches to remediate the specific integer underflow vulnerability in Adobe Photoshop, eliminating the root cause of arbitrary code execution.
SI-16 enforces memory protections such as ASLR and DEP that mitigate arbitrary code execution exploits triggered by the integer underflow when processing malicious files.
RA-5 requires vulnerability scanning to identify systems running vulnerable versions of Photoshop affected by CVE-2025-21122.