CVE-2025-21158
Published: 11 February 2025
Summary
CVE-2025-21158 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 23.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-21158 is an Integer Underflow (Wrap or Wraparound) vulnerability, classified under CWE-191, affecting Adobe InDesign Desktop versions ID20.0, ID19.5.1, and earlier. This flaw could lead to arbitrary code execution in the context of the current user. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2025-02-11.
Exploitation requires local access and user interaction, specifically tricking a victim into opening a malicious file with a vulnerable InDesign installation. No special privileges are needed (PR:N), and the attack complexity is low (AC:L). Successful exploitation allows an attacker to achieve high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H) within the user's context, without changing scope.
Adobe's security bulletin APSB25-01, available at https://helpx.adobe.com/security/products/indesign/apsb25-01.html, provides details on mitigation and available patches for affected InDesign versions.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2250
Vulnerability details
InDesign Desktop versions ID20.0, ID19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…
more
a victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer underflow in InDesign enables client-side RCE via crafted malicious file opened by user (T1203 + T1204.002).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely patching of the integer underflow vulnerability in affected InDesign versions per Adobe bulletin APSB25-01 to prevent arbitrary code execution.
Vulnerability scanning identifies systems with vulnerable InDesign installations, enabling prioritization and remediation of this specific CVE.
Memory protection mechanisms like non-executable memory and ASLR mitigate arbitrary code execution resulting from the integer underflow even if unpatched.