CVE-2025-21126: Adobe InDesign DOS Vulnerability

CVE-2025-21126 Overview

Adobe InDesign Desktop contains an improper input validation vulnerability that enables an application denial-of-service condition. The flaw affects InDesign Desktop versions ID20.0, ID19.5.1, and earlier releases on both Windows and macOS. An attacker can craft a malicious InDesign file that causes the application to crash when opened by a victim. Exploitation requires user interaction because the target must open the malicious file locally. Adobe addressed the issue in security bulletin APSB25-01.

Critical Impact
Successful exploitation crashes the InDesign application, interrupting workflows and causing loss of unsaved work for affected users.

Affected Products

Adobe InDesign Desktop ID20.0
Adobe InDesign Desktop ID19.5.1 and earlier
Microsoft Windows and Apple macOS installations of the affected versions

Discovery Timeline

2025-02-11 - CVE-2025-21126 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-21126

Vulnerability Analysis

The vulnerability is categorized under [CWE-20] Improper Input Validation. InDesign fails to properly validate structural fields within a document file before processing them. When the parser encounters malformed input, the application enters an unrecoverable error state and terminates. The impact is limited to availability; confidentiality and integrity are not affected. The attack is local and requires the victim to open an attacker-supplied file, which aligns with common document-based social engineering workflows.

Root Cause

The root cause is missing or insufficient validation of input data parsed from an InDesign document. Adobe has not published parser internals, but the behavior is consistent with an input field that bypasses sanity checks and triggers a fatal condition during document load. See the Adobe InDesign Security Advisory APSB25-01 for vendor-confirmed details.

Attack Vector

An attacker crafts a malicious .indd or related InDesign file and delivers it through email, file-sharing services, or a compromised collaboration channel. When the victim opens the file in a vulnerable InDesign Desktop build, the parser hits the unvalidated condition and the application crashes. The attacker gains no code execution or data access; only availability is impacted.

Detection Methods for CVE-2025-21126

Indicators of Compromise

Repeated unexpected terminations of InDesign.exe (Windows) or the Adobe InDesign process (macOS) shortly after a user opens an external document.
Windows Application Event Log entries showing crash events (Event ID 1000) referencing the InDesign binary.
Presence of recently received InDesign files from untrusted or unknown senders in user download or mail attachment directories.

Detection Strategies

Monitor endpoint telemetry for abnormal exit codes or crash dumps generated by InDesign processes.
Correlate file-open events for InDesign document types with subsequent process termination within a short time window.
Inventory InDesign installations and flag hosts running versions at or below ID20.0 and ID19.5.1.

Monitoring Recommendations

Enable crash reporting and forward Windows Error Reporting (WER) and macOS CrashReporter artifacts to a central log store.
Track user reports of repeated InDesign crashes tied to specific files for triage by the security team.
Review email and file-sharing gateway logs for inbound InDesign documents from external senders.

How to Mitigate CVE-2025-21126

Immediate Actions Required

Upgrade Adobe InDesign Desktop to the fixed versions listed in Adobe advisory APSB25-01.
Instruct users to avoid opening InDesign files received from untrusted sources until patching is complete.
Validate the deployed InDesign version across managed endpoints using software inventory tooling.

Patch Information

Adobe released fixed builds of InDesign Desktop as described in the Adobe InDesign Security Advisory APSB25-01. Apply the vendor-provided updates through the Adobe Creative Cloud desktop application or enterprise deployment tooling.

Workarounds

Restrict opening of InDesign documents to files originating from trusted internal sources until patches are deployed.
Use a sandboxed or non-production workstation to triage suspicious InDesign files.
Enable auto-save and frequent recovery snapshots in InDesign to limit data loss from unexpected crashes.

bash

# Verify installed Adobe InDesign version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"

# Verify installed Adobe InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
  Select-Object DisplayName, DisplayVersion