CVE-2025-21134
Published: 14 January 2025
Summary
CVE-2025-21134 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Adobe Illustrator On Ipad. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 46.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21134 is an Integer Underflow (Wrap or Wraparound) vulnerability, classified as CWE-191, affecting Adobe Illustrator on iPad versions 3.0.7 and earlier. The flaw resides in the application and could result in arbitrary code execution in the context of the current user.
Exploitation requires local access with low complexity and no privileges, but user interaction is necessary as a victim must open a malicious file. An attacker can craft such a file to trick the user into opening it, achieving high impacts on confidentiality, integrity, and availability, as reflected in the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Adobe Security Bulletin APSB25-04 provides details on mitigation, available at https://helpx.adobe.com/security/products/illustrator-mobile-ios/apsb25-04.html. The bulletin was published on 2025-01-14.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2241
Vulnerability details
Illustrator on iPad versions 3.0.7 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…
more
a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer underflow in Adobe Illustrator enables arbitrary code execution upon opening a crafted malicious file, directly facilitating T1204.002 User Execution via Malicious File.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of known software flaws like the integer underflow vulnerability in Adobe Illustrator on iPad, preventing exploitation through patching as advised in APSB25-04.
Mandates vulnerability monitoring and scanning to identify systems running vulnerable versions of Adobe Illustrator affected by CVE-2025-21134.
Implements memory protections such as ASLR and DEP to mitigate arbitrary code execution resulting from the integer underflow when a malicious file is opened.