CVE-2025-21157
Published: 11 February 2025
Summary
CVE-2025-21157 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 22.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the out-of-bounds write vulnerability via vendor patches for affected InDesign versions.
Implements memory protections such as DEP and ASLR to prevent arbitrary code execution from out-of-bounds write exploits.
Provides malicious code scanning to detect and block malicious InDesign files before they trigger the vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in file-processing client app directly enables client-side exploitation via malicious file opened by user, resulting in arbitrary code execution.
NVD Description
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-21157 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.0, ID19.5.1, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-02-11.
Exploitation requires local access and user interaction, specifically tricking a victim into opening a malicious file within the affected InDesign versions. No privileges are needed (PR:N), and the attack has low complexity (AC:L). Successful exploitation allows an attacker to achieve high-impact confidentiality, integrity, and availability violations, executing arbitrary code with the privileges of the current user.
Adobe's security bulletin APSB25-01, available at https://helpx.adobe.com/security/products/indesign/apsb25-01.html, details mitigation steps, including available patches for supported InDesign versions.
Details
- CWE(s)