EUVD-2025-17810Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
InCopy versions 20.2, 19.5.3 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
CVE-2025-30327 is an integer overflow vulnerability in Adobe InCopy that enables arbitrary code execution with the privileges of the current user. Versions 20.2, 19.5.3 and earlier are affected; exploitation requires a user to open a malicious file, making it a file-based attack vector with moderate attack complexity. The vulnerability has a CVSS score of 7.8 (high severity) with complete impact on confidentiality, integrity, and availability, though real-world exploitation depends on user interaction and file delivery success.
Technical ContextAI
The vulnerability resides in integer overflow/wraparound logic (CWE-190) within Adobe InCopy's file parsing or memory management subsystems. Integer overflows occur when arithmetic operations on integers exceed the maximum representable value, causing wraparound to negative or small positive numbers. In this context, the overflow likely occurs during deserialization of malicious InCopy document files (.indd or related formats), where an attacker crafts a document with specially-crafted integer values that cause buffer allocation miscalculations. This leads to heap buffer overflows or out-of-bounds memory access, enabling shellcode execution in the application's memory space. The vulnerability affects Adobe InCopy versions: CPE would be cpe:2.3:a:adobe:incopy:20.2:*:*:*:*:*:*:* and cpe:2.3:a:adobe:incopy:19.5.3:*:*:*:*:*:*:* (and earlier minor versions of 19.5.x). The defect is in native code processing, likely C/C++ components handling document structure parsing.
RemediationAI
Patching: Upgrade to Adobe InCopy version 21.0 or later (specific patched version to be confirmed from Adobe security advisory). Adobe typically releases patches monthly; check Adobe Security Bulletins for CVE-2025-30327 patch dates.; priority: Critical Workaround: Restrict opening of .indd and related InCopy documents from untrusted sources. Disable or restrict InCopy file opening capabilities if unused. Use file-level sandboxing or containerization for InCopy processes when processing externally-sourced documents.; priority: High Detection: Monitor for InCopy process crashes, unusual memory access patterns, or unexpected spawning of child processes following document opens. EDR solutions should alert on InCopy heap corruption indicators or shellcode patterns.; priority: Medium Vendor Advisory: Consult Adobe Security Bulletin APSB-2025-[XX] (anticipated) for official patch availability, affected build numbers, and timeline. Adobe product security page (adobe.com/security) will publish CVE details and patches.; priority: Critical
Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. Rate
InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Heap-based buffer overflow vulnerability in Adobe InCopy versions 20.2, 19.5.3 and earlier that allows arbitrary code ex
InCopy versions 20.3, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in
InCopy versions 20.3, 19.5.3 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could res
InCopy versions 20.3, 19.5.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Arbitrary code execution in Adobe InCopy versions 21.0, 19.5.5 and earlier through a heap-based buffer overflow when use
Arbitrary code execution in Adobe InCopy 20.5.2, 21.2 and earlier allows unauthenticated local attackers to execute mali
Out-of-bounds read in Adobe InCopy 20.5.2, 21.2 and earlier allows arbitrary code execution when users open malicious fi
Arbitrary code execution in Adobe InCopy versions 21.3, 20.5.3 and earlier occurs when a user opens a maliciously crafte
Arbitrary code execution in Adobe InCopy 21.3, 20.5.3, and earlier allows attackers to run code as the current user when
Stack-based buffer overflow in Adobe InCopy 21.3, 20.5.3 and earlier enables arbitrary code execution in the context of
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today