EUVD-2025-17696
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Analysis
Use-after-free vulnerability in Adobe InDesign Desktop that allows arbitrary code execution with the privileges of the current user. Affected versions are InDesign ID20.2, ID19.5.3, and earlier; exploitation requires a victim to open a malicious file. This is a high-severity local vulnerability with user interaction required, but without confirmed active exploitation data or public POC availability indicated in the provided intelligence.
Technical Context
This vulnerability exploits a use-after-free (UAF) memory safety flaw classified under CWE-416. UAF vulnerabilities occur when software references memory that has already been freed, allowing attackers to corrupt memory state or execute arbitrary code by crafting malicious input that triggers the vulnerable code path. In InDesign's context, this likely involves document processing logic—specifically the parsing and rendering of document files (InDesign Document Format, INDD, or related formats). The vulnerability is triggered during file deserialization or document initialization, where an object pointer is dereferenced after being freed, potentially allowing heap spray techniques or controlled memory layouts to achieve code execution. InDesign's rich document handling capabilities and complex file parsing make it a suitable target for memory corruption attacks.
Affected Products
Adobe InDesign Desktop versions affected: (1) ID20.2 and earlier in the 20.x branch; (2) ID19.5.3 and earlier in the 19.x branch. Estimated CPE range: cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:* (versions ≤20.2 and ≤19.5.3 for their respective branches). The vulnerability likely affects all supported platforms (Windows and macOS) where InDesign Desktop is deployed. Related products may include InDesign Server, but the advisory specifically names InDesign Desktop.
Remediation
Patch to InDesign versions greater than ID20.2 in the 20.x branch or greater than ID19.5.3 in the 19.x branch (e.g., ID21.x or ID20.3+, pending Adobe's release cycle). Users unable to patch immediately should: (1) avoid opening untrusted or unexpected InDesign document files from unknown sources; (2) disable automatic document opening in email clients; (3) run InDesign in restricted user contexts where possible; (4) implement file-level access controls and document validation workflows. Adobe should provide specific patch version numbers and release dates via their official security bulletin and PSIRT advisories. Check Adobe's Security Center and InDesign release notes for CVE-2025-43589 patch details.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today