EUVD-2025-17703
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Analysis
CVE-2025-43590 is an out-of-bounds write vulnerability in Adobe InDesign Desktop that allows arbitrary code execution with the privileges of the current user. Affected versions include ID20.2, ID19.5.3, and earlier releases. Exploitation requires user interaction-specifically opening a malicious file-but once triggered, grants an attacker full code execution capabilities in the context of the authenticated user.
Technical Context
This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption flaw where the application writes data beyond the boundaries of allocated memory buffers. In the context of Adobe InDesign—a complex document processing application handling multiple file formats (INDD, PDF, EPS, etc.)—this flaw likely occurs during parsing or rendering of crafted document structures. The out-of-bounds write could overwrite adjacent heap or stack memory, corrupting function pointers, object metadata, or return addresses. Adobe InDesign's document parsing engine (handling proprietary INDD formats and embedded assets) is the probable attack surface. The vulnerability affects CPE entries for Adobe InDesign: cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:* (versions ≤20.2 on Desktop).
Affected Products
Adobe InDesign Desktop (['ID20.2 and earlier', 'ID19.5.3 and earlier'])
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today