CVE-2025-27166
Published: 11 March 2025
Summary
CVE-2025-27166 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation and patching of the out-of-bounds write vulnerability in affected Adobe InDesign versions as specified in Adobe's security bulletin APSB25-19.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention that directly mitigate out-of-bounds write exploits leading to arbitrary code execution.
Enables vulnerability scanning to identify the presence of CVE-2025-27166 in InDesign installations, facilitating targeted patching and remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in Adobe InDesign enables arbitrary code execution via opening a malicious file, directly mapping to client-side exploitation (T1203) and user execution through malicious file (T1204.002).
NVD Description
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-27166 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions 20.1, 19.5.2, and earlier. The flaw resides in the software's handling of files, potentially leading to arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. Per the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), an attacker needs local access with low attack complexity and no privileges, but must convince the user to open the file. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability in the user's context.
Adobe's security bulletin APSB25-19, published at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, details patches and mitigation guidance for affected versions.
Details
- CWE(s)