CVE-2025-27175
Published: 11 March 2025
Summary
CVE-2025-27175 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the out-of-bounds write vulnerability by requiring timely testing and installation of Adobe-provided patches for affected InDesign versions.
Implements memory protection techniques like non-executable memory segments and ASLR to prevent arbitrary code execution resulting from the out-of-bounds write.
Provides malicious code protection mechanisms that scan and block specially crafted malicious files before they can be opened in InDesign.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an out-of-bounds write in Adobe InDesign that enables arbitrary code execution when a user opens a specially crafted malicious file, directly facilitating T1204.002 User Execution: Malicious File.
NVD Description
InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2025-27175 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. This flaw could lead to arbitrary code execution in the context of the current user when processing malicious files.
The vulnerability has a CVSS v3.1 base score of 7.8 (High), with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating low attack complexity, no required privileges, and user interaction via opening a malicious file. A local attacker could exploit it by tricking a victim into opening a specially crafted file, achieving full control over the affected system with high impacts to confidentiality, integrity, and availability in the user's context.
Adobe's security bulletin APSB25-19, detailed at https://helpx.adobe.com/security/products/indesign/apsb25-19.html, provides information on mitigation, including available patches for affected InDesign versions.
Details
- CWE(s)