Adobe Dimension CVE-2025-61799

Exploitation requires the victim to open an attacker-crafted file in Adobe Dimension (version 4.1.4 or earlier); there is no network-reachable or unauthenticated path. The specific prerequisite is user interaction - a user must be convinced to open a malicious file that is then parsed by Dimension's file-parsing code. Limiting factors: local attack vector (AV:L) means the attacker cannot trigger it remotely without first delivering the file, mandatory user interaction (UI:R) requires social engineering, and only the affected versions (<=4.1.4) are vulnerable, so patched installations are not at risk. No special non-default configuration is required beyond having Dimension installed and opening the file.

Signals are largely consistent and point to a genuine-but-not-urgent client-side risk. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) correctly describes a local-vector flaw that requires a victim to open a crafted file - it is not remotely reachable, which is the dominant risk-limiting factor despite the 7.8 'High' base score driven by C:H/I:H/A:H. EPSS is low (0.22%, 12th percentile), indicating low probability of exploitation in the near term, and the flaw is NOT on CISA KEV, so there is no confirmed active exploitation. No POC is referenced in the provided data. These signals agree: high per-host impact (code execution as the current user) but low real-world exploitation likelihood and a delivery model (open a malicious file) that depends on social engineering. One note of caution: the underlying weakness is an out-of-bounds READ (CWE-125), yet the description and tags assert code execution and Adobe scored C:H/I:H/A:H - an OOB read most directly yields information disclosure, so the full code-execution impact likely depends on chaining the leak with memory-corruption primitives; treat the arbitrary-code-execution claim as vendor-asserted rather than independently demonstrated. No SSVC decision data was supplied in the input.

An attacker crafts a malicious Dimension-parseable file and delivers it via email, a shared project, or a download, relying on social engineering to get a victim to open it. When Dimension (4.1.4 or earlier) parses the crafted file, it reads past the end of an allocated structure, which the vendor states can be leveraged to execute code in the context of the current user. No public exploit code is identified in the provided data, and successful exploitation requires the victim to open the file.