CVE-2025-21160
Published: 11 February 2025
Summary
CVE-2025-21160 is a high-severity Wrap or Wraparound (CWE-191) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 21.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the integer underflow vulnerability in Adobe Illustrator by requiring timely installation of vendor security patches.
Identifies systems running vulnerable versions of Adobe Illustrator (29.1, 28.7.3, and earlier) through regular vulnerability scanning.
Deploys malicious code protection mechanisms to scan and block malicious files exploiting the vulnerability before user interaction or detect resulting code execution.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer underflow in file parser enables arbitrary code execution triggered by opening a malicious Illustrator file (direct match to malicious file user execution).
NVD Description
Illustrator versions 29.1, 28.7.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…
more
victim must open a malicious file.
Deeper analysisAI
CVE-2025-21160 is an Integer Underflow (Wrap or Wraparound) vulnerability, classified as CWE-191, affecting Adobe Illustrator versions 29.1, 28.7.3, and earlier. Published on 2025-02-11, the flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a local attacker with no privileges needed can exploit it with low attack complexity, leading to high impacts on confidentiality, integrity, and availability within the unchanged user scope.
Adobe's security advisory at https://helpx.adobe.com/security/products/illustrator/apsb25-11.html provides details on the issue.
Details
- CWE(s)