Adobe Dimension CVE-2025-61798
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted file via phishing
-
ExploitVictim opens file in Dimension
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactExecute code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a victim running Adobe Dimension version 4.1.4 or earlier open a maliciously crafted file; the out-of-bounds read occurs during that file's parsing. The decisive limiting factors are: (1) mandatory user interaction - the attacker cannot trigger the flaw without the victim opening the file (CVSS UI:R, AV:L), so there is no remote or automated exploitation path; (2) code runs only with the privileges of the current user, not elevated. No special non-default product configuration is required beyond having a vulnerable Dimension version installed and the ability to associate or open the crafted file in Dimension. |
| Impact | Signals are consistent and point to a moderate, non-urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity flaw that requires victim user interaction - specifically opening a crafted file - rather than remote network exploitation; the PR:N value reflects that no prior authentication is needed, but the UI:R requirement is the dominant limiting factor. EPSS is low at 0.22% (12th percentile), the CVE is not listed in CISA KEV, and no public exploit code was identified in the provided data. There is a nuance to flag explicitly: the vulnerability is rooted in an out-of-bounds READ (CWE-125) and the 'Information Disclosure' tag aligns with that primitive, yet Adobe's description and the C:H/I:H/A:H impact claim arbitrary code execution in the current user's context - a memory-disclosure bug being rated for full code execution should be verified against Adobe's advisory, as the realistic impact may skew toward information disclosure plus crash. Overall this is a genuine HIGH-severity client-side bug but a low real-world-urgency item: no active exploitation, low predicted exploitation probability, and a hard dependency on social engineering to deliver and open a malicious file. |
| Exploit ScenarioDerived | An attacker crafts a malicious Dimension-compatible file and delivers it via phishing, a shared project, or a download, then convinces a victim to open it in Adobe Dimension 4.1.4 or earlier. Parsing the crafted file triggers an out-of-bounds read that Adobe states can lead to code execution in the context of the current user. No public proof-of-concept or active exploitation was identified at the time of analysis, so this remains a theoretical, interaction-dependent scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
An out-of-bounds read during file parsing in Adobe Dimension 4.1.4 and earlier can lead to code execution in the context of the current user when a victim opens a maliciously crafted file. The flaw is rated CVSS 7.8 (AV:L/AC:L/PR:N/UI:R) and requires user interaction - the attacker cannot trigger it without the target opening the file, and any resulting code runs with the victim's own privileges rather than elevated rights. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.22% (12th percentile), which is consistent with a moderate, non-urgent remediation priority rather than an emergency response.
RemediationAI
Upgrade Adobe Dimension to a version beyond 4.1.4 using the fixed build published in Adobe security bulletin APSB25-103 (https://helpx.adobe.com/security/products/dimension/apsb25-103.html); Adobe ships these updates through the Creative Cloud desktop application, so pushing the latest release through that channel is the primary and sufficient fix. Because the provided data does not specify the exact patched version string, confirm the remediated build number directly in APSB25-103 before closing out, and do not assume 4.1.5 without verifying against the advisory. Until the update is applied, the practical compensating control is to prevent the vulnerable parser from being reached: block or strip inbound creative asset/project files delivered by email, chat, or download and treat files from untrusted sources as executable content, and, where operationally feasible, restrict or disable file-type association and automatic preview/import of externally sourced assets for non-design users. The trade-off is reduced workflow flexibility and help-desk friction for legitimate 3D asset exchange; conversely, opening untrusted files - even those that only need a preview - removes the UI:R barrier entirely and re-enables exploitation. Standard endpoint controls such as running Dimension as a non-administrative user reduce the value of the code-execution outcome (no privilege escalation is gained per the S:U/PR:N/L assessment) but do not prevent the out-of-bounds read itself. Patch status per available data: vendor advisory identifying a fixed release is available; the exact patched version is not confirmed in the input. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so emergency out-of-band deployment is not indicated - schedule the upgrade in the normal patch cycle.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a memory-safety defect classified as CWE-125 (Out-of-bounds Read) in the code path that parses imported creative asset files. Adobe Dimension is a 3D design/compositing application that ingests externally supplied model, scene, and project files; when a crafted file is parsed, the parser reads past the end of an allocated memory buffer. Although the immediate primitive is an over-read (which can leak adjacent heap/stack memory and lead to information disclosure), the supplied CVSS vector assigns high confidentiality, integrity, and availability impact (C:H/I:H/A:H) and the vendor advisory states the issue can be leveraged to execute arbitrary code in the context of the current user. The vector AV:L/UI:R with PR:N confirms the trigger is local execution via a file open - no network vector and no elevated privileges - and scope is unchanged (S:U), so the blast radius is bounded by the victim's own user context. The CPE entry cpe:2.3:a:adobe:dimension:*:*:*:*:*:*:*:* carries a version wildcard, indicating the affected scope is defined by the vendor advisory (version 4.1.4 and earlier) rather than by a single platform-specific build.
Know when Dimension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Local file-open vector (AV:L) with required victim interaction (UI:R) and no prior auth (PR:N); impacts rated high per Adobe's code-execution claim, though an OOB read may realistically skew lower.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Dimension versions 4.1.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Dimension 4.1.4 and earlier is affected by a high-severity vulnerability that can lead to code execution on user workstations when a malicious file is opened. This poses a risk to creative teams and sensitive design data, potentially resulting in unauthorized access or data loss. With no vendor patch available, immediate mitigating actions are necessary to reduce exposure while maintaining design operations.
No vendor patch available. Interim mitigations include restricting use of Adobe Dimension to trusted files, applying least privilege to user accounts, disabling preview functionality if possible, and educating users on avoiding untrusted files. Consider application isolation or sandboxing for file opening.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Affected Products (CPE)CVE.org
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hija
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command exe
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account take
Arbitrary code execution in Adobe Dimension 4.1.4 and earlier is possible through a use-after-free (CWE-416) triggered w
Opening a maliciously crafted file in Adobe Dimension 4.1.4 and earlier can trigger an integer overflow (CWE-190) during
Out-of-bounds read in Adobe Dimension 4.1.4 and earlier can be escalated to code execution in the context of the current
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
GitHub PoC
Exploit-DB