CVE-2025-61824CWE-122CWE-787

CVE-2025-61824

High · published November 11, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

🚨 A single click could lead to chaos! A heap-based buffer overflow in InDesign Desktop lets attackers execute arbitrary code simply by opening a malicious file. ⚡ Think of it like a restaurant where a waiter serves a dish that looks fine but has a hidden mix of ingredients meant to make the chef’s secret recipe go haywire. If a user opens a malicious InDesign file, it’s like that waiter delivering the rogue dish — opening the door to all sorts of mischief! An attacker could gain control of the user's system, potentially stealing sensitive data, installing malware, or causing other untold damage. This exploitation could turn a creative software session into a nightmare, leading to unwanted consequences and loss of data.

Put simply

Think of it like a restaurant where a waiter serves a dish that looks fine but has a hidden mix of ingredients meant to make the chef’s secret recipe go haywire. If a user opens a malicious InDesign file, it’s like that waiter delivering the rogue dish — opening the door to all sorts of mischief! This vulnerability allows a heap-based buffer overflow, enabling attackers to execute arbitrary code in the context of the current user whenever they open a specially crafted malicious file in InDesign Desktop versions 20.5, 19.5.5, or earlier.

What to do

An attacker could gain control of the user's system, potentially stealing sensitive data, installing malware, or causing other untold damage. This exploitation could turn a creative software session into a nightmare, leading to unwanted consequences and loss of data. To protect yourself, immediately update InDesign Desktop to the latest version to patch this vulnerability. Educate users to be cautious about opening files from unknown sources, and consider deploying security tools that can scan files before they're opened. You've got this! Follow these steps and you'll bolster your defenses against this sneaky exploit! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00332 · 25.2th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2025-11-11T22:15Z
Affected products (2)
ProductVersionsFixed in
adobe/indesign≤ 19.5.5—
adobe/indesign≥ 20.0, < 20.5.120.5.1
References (1)
EPSS history
Timeline
  • 11 NOV 17:00Z
    InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
    cvelistv5