What is the CVSS score of CVE-2025-43589?

CVE-2025-43589 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Indesign are affected by CVE-2025-43589?

A critical vulnerability in Adobe InDesign Desktop versions 20.2, 19.5.3 and earlier allows attackers to execute arbitrary code on affected systems when users open malicious design files.

How to fix or mitigate CVE-2025-43589?

Within 24 hours: Identify and inventory all InDesign Desktop installations across the organization, particularly those running versions 20.2, 19.5.3 or earlier; issue security advisory to design teams prohibiting opening files from untrusted sources. Within 7 days: Establish file review procedures requiring validation of InDesign files before opening; consider restricting InDesign access to isolated workstations; evaluate upgrade to versions 21.0 or later if available. Within 30 days: Complete migration of all affected systems to patched versions once Adobe releases a fix; implement endpoint detection and response (EDR) monitoring for InDesign process anomalies.

Indesign CVE-2025-43589

EUVD-2025-17696 HIGH

Use After Free (CWE-416)

2025-06-10 psirt@adobe.com

Use After Free RCE Adobe Indesign

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17696

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:23 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Use-after-free vulnerability in Adobe InDesign Desktop that allows arbitrary code execution with the privileges of the current user. Affected versions are InDesign ID20.2, ID19.5.3, and earlier; exploitation requires a victim to open a malicious file. This is a high-severity local vulnerability with user interaction required, but without confirmed active exploitation data or public POC availability indicated in the provided intelligence.

Technical ContextAI

This vulnerability exploits a use-after-free (UAF) memory safety flaw classified under CWE-416. UAF vulnerabilities occur when software references memory that has already been freed, allowing attackers to corrupt memory state or execute arbitrary code by crafting malicious input that triggers the vulnerable code path. In InDesign's context, this likely involves document processing logic—specifically the parsing and rendering of document files (InDesign Document Format, INDD, or related formats). The vulnerability is triggered during file deserialization or document initialization, where an object pointer is dereferenced after being freed, potentially allowing heap spray techniques or controlled memory layouts to achieve code execution. InDesign's rich document handling capabilities and complex file parsing make it a suitable target for memory corruption attacks.

RemediationAI

Patch to InDesign versions greater than ID20.2 in the 20.x branch or greater than ID19.5.3 in the 19.x branch (e.g., ID21.x or ID20.3+, pending Adobe's release cycle). Users unable to patch immediately should: (1) avoid opening untrusted or unexpected InDesign document files from unknown sources; (2) disable automatic document opening in email clients; (3) run InDesign in restricted user contexts where possible; (4) implement file-level access controls and document validation workflows. Adobe should provide specific patch version numbers and release dates via their official security bulletin and PSIRT advisories. Check Adobe's Security Center and InDesign release notes for CVE-2025-43589 patch details.