Adobe Dimension CVE-2025-61800
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious Dimension file to victim
-
DeliveryVictim opens file in Dimension
-
ExploitTrigger integer overflow in parser
-
ExecutionCorrupt memory and hijack execution
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a user running Adobe Dimension version 4.1.4 or earlier opens an attacker-crafted file in the application; the integer overflow is triggered during processing of that malicious file. Limiting factors: the attack is LOCAL (AV:L) and cannot be executed remotely without victim action - mandatory user interaction (UI:R) means the attacker must socially engineer the target into opening the file, and code execution is confined to the privileges of the current user (S:U), so it does not by itself yield elevated or system-level privileges. This is not a default-configuration remote attack; it depends on file delivery and user behavior. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side file-parsing flaw: the attack vector is LOCAL (AV:L) and requires user interaction (UI:R) - the victim must open a malicious file - so despite PR:N this is NOT remotely exploitable against a network-facing service. The EPSS score is low (0.22%, 12th percentile), consistent with a desktop application vulnerability that is not mass-scanned or wormable. There is no CISA KEV listing and no public exploit identified in the provided data, so there is no evidence of active exploitation or weaponization. The signals are internally consistent - low EPSS, local vector, user-interaction dependency all point to a flaw that would be exploited in targeted social-engineering or supply-of-malicious-asset scenarios rather than opportunistic mass exploitation. The HIGH severity is driven entirely by the full C/I/H/A impact of arbitrary code execution, not by ease or likelihood of exploitation. No SSVC decision data was provided in the input, so automatable/exploitation-status cannot be cross-referenced from that framework. |
| Exploit ScenarioDerived | An attacker crafts a malicious Adobe Dimension project or asset file that triggers the integer overflow (CWE-190) during parsing, then delivers it via email, a shared design asset, or a download and socially engineers a designer into opening it. When the victim opens the file in Dimension 4.1.4 or earlier, the overflow leads to memory corruption and arbitrary code execution in the context of the current user. No public proof-of-concept exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Opening a maliciously crafted file in Adobe Dimension 4.1.4 and earlier can trigger an integer overflow (CWE-190) during file parsing that culminates in arbitrary code execution with the privileges of the current user. The attack is local (AV:L) and requires the victim to open the crafted file (UI:R), so it depends on file delivery and social engineering rather than remote, default-configuration exploitation, and code execution does not by itself escape the user's privilege context (S:U). No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.22% (12th percentile), making this a credible but not emergency-tier priority.
RemediationAI
Apply the corrected Adobe Dimension release identified in Adobe Security Bulletin APSB25-103 (https://helpx.adobe.com/security/products/dimension/apsb25-103.html), which addresses all affected versions up to and including 4.1.4; an exact patched version number is not specified in the supplied data, so confirm the fixed build from the bulletin before rollout. Until the update is deployed, treat file opening as the attack surface: block or strip 3D asset and project files received from untrusted external senders at the email gateway and file-share layer, which removes the delivery path at the cost of some workflow friction for legitimate asset exchange, and refrain from opening Dimension files from unknown or unsolicited sources. Where feasible, run Dimension under a dedicated low-privilege account and use OS application-control policies (e.g., allowlisting the Dimension executable and constraining its file-system write paths) so that any successful exploitation is confined to limited user rights, though this does not prevent the code-execution primitive itself. Vendor-released patch is available per the APSB25-103 advisory; no public exploit code was identified, so these compensating controls are precautionary rather than incident-driven.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an integer overflow or wraparound (CWE-190) in Adobe Dimension, a 3D design and compositing application that parses imported asset files produced by third-party modeling tools. When parsing attacker-controlled data from such a file, arithmetic involving a length, size, or counter value can wrap past its type boundary, producing a value far smaller or larger than intended; that miscalculated value is then used for a memory allocation or bounds check, resulting in an undersized buffer and subsequent out-of-bounds memory corruption. Because the corrupted memory region can be shaped by the file contents, an attacker can redirect execution flow and achieve arbitrary code execution inside the Dimension process. The CPE entry cpe:2.3:a:adobe:dimension:*:*:*:*:*:*:*:* confirms the entire Dimension product line as the affected surface, with the vendor bulletin narrowing applicability to version 4.1.4 and earlier. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows the overflow requires no prior privileges (PR:N) and is of low attack complexity, but is constrained to a local attack vector with mandatory user interaction and unchanged scope, meaning the resulting code executes only at the user's existing privilege level.
Know when Dimension gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing RCE: AV:L and UI:R because the victim must locally open a malicious file, PR:N as no prior auth is needed, full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Dimension versions 4.1.4 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Dimension versions 4.1.4 and earlier contain a high-severity integer overflow vulnerability that can allow arbitrary code execution when a user opens a malicious file. This poses a risk to design teams who rely on the software, potentially leading to unauthorized access to sensitive data or systems. However, no public exploit identified at time of analysis, and with no vendor-released patch identified at time of analysis, organizations should focus on interim mitigations while awaiting an official fix.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting the opening of untrusted files, enforcing least privilege for users, implementing application control or sandboxing, and conducting user awareness training.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
Privilege escalation to account takeover in WatchGuard Dimension allows a low-privileged Dimension Administrator to hija
WatchGuard Dimension's log listening service can be rendered unavailable by an unauthenticated remote attacker flooding
Authenticated SQL injection in WatchGuard Dimension's scheduled report feature permits arbitrary OS command execution as
Authenticated SQL injection in WatchGuard Dimension's audit report feature enables privilege escalation to arbitrary OS
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command exe
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account take
Arbitrary code execution in Adobe Dimension 4.1.4 and earlier is possible through a use-after-free (CWE-416) triggered w
Out-of-bounds read in Adobe Dimension 4.1.4 and earlier can be escalated to code execution in the context of the current
An out-of-bounds read during file parsing in Adobe Dimension 4.1.4 and earlier can lead to code execution in the context
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
Dimension versions 4.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary
GitHub PoC
Exploit-DB