What is the CVSS score of CVE-2025-47107?

CVE-2025-47107 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Incopy are affected by CVE-2025-47107?

CVE-2025-47107 is a high-severity vulnerability affecting InCopy versions 20.2, 19.5.3 and earlier that could allow attackers to execute arbitrary code on user systems through malicious file attacks.

How to fix or mitigate CVE-2025-47107?

Within 24 hours: Assess InCopy deployment scope across the organization and notify affected users to avoid opening files from untrusted sources. Within 7 days: Implement user awareness training emphasizing file validation, document origin verification, and reporting suspicious requests; establish file transfer controls limiting InCopy document sources to trusted internal channels. Within 30 days: Monitor vendor communications for patch availability and establish a rapid deployment plan; consider evaluating alternative workflows or temporary restrictions on InCopy file handling for high-risk user populations.

Incopy CVE-2025-47107

EUVD-2025-17811 HIGH

Heap-based Buffer Overflow (CWE-122)

2025-06-10 psirt@adobe.com

Buffer Overflow RCE Adobe Incopy

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 19:49 euvd

EUVD-2025-17811

Analysis Generated

Mar 14, 2026 - 19:49 vuln.today

CVE Published

Jun 10, 2025 - 19:15 nvd

HIGH 7.8

DescriptionCVE.org

InCopy versions 20.2, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow vulnerability in Adobe InCopy versions 20.2, 19.5.3 and earlier that allows arbitrary code execution with the privileges of the current user. The vulnerability requires user interaction (opening a malicious file) and presents a high-severity risk due to its direct code execution capability; exploitation likelihood and real-world attack status cannot be fully assessed without KEV confirmation or public POC availability.

Technical ContextAI

The vulnerability exists as a CWE-122 (Heap-based Buffer Overflow) in Adobe InCopy, a professional writing and editing component of the Creative Cloud suite. Heap-based buffer overflows occur when data written to a heap buffer exceeds its allocated size, corrupting adjacent heap metadata and potentially allowing attackers to overwrite function pointers, virtual method tables, or other critical data structures. The affected CPE likely corresponds to cpe:2.3:a:adobe:incopy:* with version constraints <=20.2 and <=19.5.3 (legacy branch). InCopy's file parsing routines (likely handling native .icml or linked document formats) fail to perform adequate bounds checking during buffer operations, enabling an attacker to craft a malicious document that triggers the overflow when processed.

RemediationAI

action: Apply vendor patch; details: Update Adobe InCopy to a patched version released after CVE-2025-47107 disclosure. Check Adobe's official security bulletin for specific build numbers. Versions >20.2 and >19.5.3 (if still supported) should resolve the heap buffer overflow.
action: Restrict document sources; details: Implement organizational policy to open InCopy documents (.icml, linked files) only from trusted sources until patching is complete. Use file isolation tools or sandboxed environments for document preview/review from untrusted senders.
action: Monitor for exploitation indicators; details: Analyze system logs for unexpected process spawning from InCopy, unusual memory access patterns, or application crashes. Endpoint Detection and Response (EDR) tools should flag heap exploitation techniques.
action: Vendor advisory reference; details: Consult Adobe Security Advisory (APSB-2025-XX or equivalent) for definitive patch versions, timeline, and workaround specifics. Adobe typically publishes patches on Patch Tuesday or ad-hoc for critical vulnerabilities.