What is the CVSS score of CVE-2025-43590?

CVE-2025-43590 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Indesign are affected by CVE-2025-43590?

Adobe InDesign Desktop contains a critical out-of-bounds write vulnerability (CVE-2025-43590) that allows attackers to execute arbitrary code on affected systems when users open malicious files.

How to fix or mitigate CVE-2025-43590?

Within 24 hours: Issue security alert to all InDesign users; restrict file sharing from untrusted external sources. Within 7 days: Implement mandatory user awareness training on opening files only from trusted sources; monitor InDesign process execution logs for suspicious activity. Within 30 days: Evaluate upgrade path to patched versions when available; implement application whitelisting to restrict InDesign execution to approved contexts.

Indesign CVE-2025-43590

EUVD-2025-17703 HIGH

Out-of-bounds Write (CWE-787)

2025-06-10 psirt@adobe.com

Buffer Overflow RCE Adobe Indesign

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17703

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 17:23 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

CVE-2025-43590 is an out-of-bounds write vulnerability in Adobe InDesign Desktop that allows arbitrary code execution with the privileges of the current user. Affected versions include ID20.2, ID19.5.3, and earlier releases. Exploitation requires user interaction-specifically opening a malicious file-but once triggered, grants an attacker full code execution capabilities in the context of the authenticated user.

Technical ContextAI

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption flaw where the application writes data beyond the boundaries of allocated memory buffers. In the context of Adobe InDesign—a complex document processing application handling multiple file formats (INDD, PDF, EPS, etc.)—this flaw likely occurs during parsing or rendering of crafted document structures. The out-of-bounds write could overwrite adjacent heap or stack memory, corrupting function pointers, object metadata, or return addresses. Adobe InDesign's document parsing engine (handling proprietary INDD formats and embedded assets) is the probable attack surface. The vulnerability affects CPE entries for Adobe InDesign: cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:* (versions ≤20.2 on Desktop).