CVE-2025-61824
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a heap-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
Risk Assessment
Opening a crafted file may lead to execution of malicious code with the user's privileges, risking workstation and data compromise. The risk is especially relevant in creative environments processing files from unknown sources.
Recommendation
Update Adobe InDesign Desktop to the latest patched version. Train users not to open files from untrusted sources.
Other vulnerabilities in Adobe InDesign Desktop
See all- CVE-2026-34629High
A heap-based buffer overflow vulnerability in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier could result in arbitrary code execution in the context of the current user when opening a malicious file.
- CVE-2026-34628High
A heap-based buffer overflow vulnerability in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier could result in arbitrary code execution in the context of the current user when opening a malicious file.
- CVE-2026-34627High
A heap-based buffer overflow vulnerability in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier could result in arbitrary code execution in the context of the current user when opening a malicious file.
- CVE-2025-61832High
InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a heap-based buffer overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.
Original NVD description (English source)
InDesign Desktop versions 20.5, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS