Cyber Posture

CVE-2025-27166

High

Published: 11 March 2025

Published
11 March 2025
Modified
28 April 2025
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0010 27.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27166 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires timely remediation and patching of the out-of-bounds write vulnerability in affected Adobe InDesign versions as specified in Adobe's security bulletin APSB25-19.

prevent

Implements memory protection mechanisms such as address space layout randomization and data execution prevention that directly mitigate out-of-bounds write exploits leading to arbitrary code execution.

detect

Enables vulnerability scanning to identify the presence of CVE-2025-27166 in InDesign installations, facilitating targeted patching and remediation.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Out-of-bounds write in Adobe InDesign enables arbitrary code execution via opening a malicious file, directly mapping to client-side exploitation (T1203) and user execution through malicious file (T1204.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…

more

open a malicious file.

Deeper analysisAI

CVE-2025-27166 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions 20.1, 19.5.2, and earlier. The flaw resides in the software's handling of files, potentially leading to arbitrary code execution in the context of the current user.

Exploitation requires user interaction, as a victim must open a malicious file. Per the CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), an attacker needs local access with low attack complexity and no privileges, but must convince the user to open the file. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability in the user's context.

Adobe's security bulletin APSB25-19, published at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, details patches and mitigation guidance for affected versions.

Details

CWE(s)

Affected Products

adobe
indesign
≤ 19.5.3 · 20.0 — 20.2

CVEs Like This One

CVE-2025-24452Same product: Adobe Indesign
CVE-2025-21157Same product: Adobe Indesign
CVE-2025-21121Same product: Adobe Indesign
CVE-2025-27178Same product: Adobe Indesign
CVE-2026-21277Same product: Adobe Indesign
CVE-2025-27175Same product: Adobe Indesign
CVE-2025-27171Same product: Adobe Indesign
CVE-2026-21357Same product: Adobe Indesign
CVE-2025-24453Same product: Adobe Indesign
CVE-2025-27177Same product: Adobe Indesign

References