CVE-2025-27169
Published: 11 March 2025
Summary
CVE-2025-27169 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Illustrator. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the vulnerability by requiring organizations to identify, prioritize, and remediate flaws like this out-of-bounds write in affected Adobe Illustrator versions via vendor patches.
Provides memory protection mechanisms such as address space layout randomization and data execution prevention that mitigate exploitation of out-of-bounds write vulnerabilities leading to arbitrary code execution.
Enables vulnerability scanning to identify systems running vulnerable Adobe Illustrator versions (29.2.1, 28.7.4, and earlier), triggering remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write enables arbitrary code execution via malicious file opened by user, directly mapping to client-side exploitation (T1203) and user execution with malicious file (T1204.002).
NVD Description
Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
Deeper analysisAI
CVE-2025-27169 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe Illustrator versions 29.2.1, 28.7.4, and earlier. Published on 2025-03-11T18:15:35.077, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. An attacker needs only local access with no privileges and can leverage the low-complexity attack to achieve high impacts on confidentiality, integrity, and availability within the unchanged security scope.
Adobe's security advisory APSB25-17 at https://helpx.adobe.com/security/products/illustrator/apsb25-17.html provides details on mitigation and available patches.
Details
- CWE(s)