Adobe Security Bulletin

Security Update Available for Adobe InDesign | APSB25-19

Bulletin ID

Date Published

Priority

APSB25-19

March 11, 2025

3

Summary

Adobe has released a security update for Adobe InDesign.  This update addresses critical and important vulnerabilities. Successful exploitation could lead to memory leak, arbitrary code execution and application denial-of-service.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected Versions

Product

Affected version

Platform

Adobe InDesign

ID20.1 and earlier versions

Windows and macOS 

Adobe InDesign

ID19.5.2 and earlier version.

Windows and macOS 

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their software installations via the Creative Cloud desktop app updater, or by navigating to the InDesign Help menu and clicking "Updates." For more information, please reference this help page.

Product

Updated version

Platform

Priority rating

Adobe InDesign

ID20.2

Windows and macOS 

3

Adobe InDesign

ID19.5.3

Windows and macOS 

 

3

For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information.

Vulnerability Details

Vulnerability Category

Vulnerability Impact

Severity

CVSS base score 

CVE Number

Out-of-bounds Write (CWE-787)

Memory Leak

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-24452

Heap-based Buffer Overflow (CWE-122)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-24453

Out-of-bounds Write (CWE-787)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-27166

Heap-based Buffer Overflow (CWE-122)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-27171

Out-of-bounds Write (CWE-787)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-27175

Heap-based Buffer Overflow (CWE-122)

Arbitrary code execution

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-27177

Out-of-bounds Write (CWE-787)

Memory Leak

Critical

7.8

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2025-27178

NULL Pointer Dereference (CWE-476)

Application denial-of-service

Important

5.5

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2025-27176

NULL Pointer Dereference (CWE-476)

Application denial-of-service

Important

5.5

:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2025-27179

Acknowledgments

Adobe would like to thank the following researchers for reporting these issues and for working with Adobe to help protect our customers:   

  • Francis Provencher (prl) - CVE-2025-24452, CVE-2025-24453, CVE-2025-27166, CVE-2025-27171, CVE-2025-27175, CVE-2025-27176, CVE-2025-27177, CVE-2025-27178, CVE-2025-27179

NOTE: Adobe has a public bug bounty program with HackerOne. If you are interested in working with Adobe as an external security researcher, please check out https://hackerone.com/adobe


For more information, visit https://helpx.adobe.com/security.html, or email PSIRT@adobe.com

Get help faster and easier

New user?