CVE-2025-27176: Adobe InDesign NULL Pointer DoS Vulnerability

CVE-2025-27176 Overview

CVE-2025-27176 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe InDesign Desktop versions ID20.1, ID19.5.2, and earlier. Opening a crafted file triggers the dereference and crashes the application, producing a denial-of-service condition on the local workstation. The flaw does not expose data or allow code execution, but it interrupts design workflows and can disrupt production pipelines that depend on InDesign automation. Exploitation requires user interaction: a victim must open a malicious document, typically delivered through email, shared drives, or compromised asset libraries. Adobe addressed the issue in security bulletin APSB25-19.

Critical Impact
An attacker who convinces a user to open a malicious InDesign file can crash the application and interrupt active work on the local system.

Affected Products

Adobe InDesign Desktop ID20.1 and earlier
Adobe InDesign Desktop ID19.5.2 and earlier
Microsoft Windows and Apple macOS installations of InDesign

Discovery Timeline

2025-03-11 - CVE-2025-27176 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27176

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in Adobe InDesign's file-parsing logic. When InDesign processes a specially crafted document, a code path reads from a pointer that was never initialized or was returned as NULL by an upstream allocation or lookup. Dereferencing that pointer causes an access violation and terminates the process.

The impact is limited to availability. The CVSS vector reports no confidentiality or integrity impact, consistent with an unhandled crash rather than a memory corruption bug suitable for code execution. The attack is local because the trigger requires a user to open the malicious file in InDesign.

Teams that rely on InDesign for scheduled publishing, server-side rendering, or batch processing face workflow disruption each time the application processes a weaponized file. Repeated crashes against the same input can block downstream production until the file is removed or quarantined.

Root Cause

The root cause is missing validation of a pointer prior to dereference inside InDesign's document-parsing routines. Malformed structures within an .indd or related InDesign file cause an internal object or field lookup to return NULL, and the surrounding code accesses that pointer without a prior check.

Attack Vector

An attacker crafts an InDesign document that contains the malformed structure. The attacker then delivers the file through phishing, a shared asset repository, or a third-party design handoff. When the victim opens the file, InDesign parses the malicious structure and crashes. No network access, elevated privileges, or additional exploitation primitives are required.

See the Adobe InDesign Security Update APSB25-19 for vendor technical details.

Detection Methods for CVE-2025-27176

Indicators of Compromise

Unexpected InDesign.exe or Adobe InDesign process terminations correlated with opening a specific document
Windows Application event log entries referencing an access violation (0xC0000005) in InDesign
macOS crash reports under ~/Library/Logs/DiagnosticReports/ naming Adobe InDesign with a EXC_BAD_ACCESS signal

Detection Strategies

Alert on repeated InDesign crashes originating from files delivered via email attachments, cloud storage sync, or external collaboration platforms
Correlate process termination telemetry with the file path of the most recently opened document to identify suspect assets
Flag InDesign document files received from untrusted senders for sandbox detonation before distribution to design teams

Monitoring Recommendations

Collect endpoint process start and exit telemetry for Adobe Creative Cloud applications
Forward Windows Application and macOS unified logs containing InDesign crash events to a central SIEM for correlation
Track InDesign version inventory across endpoints to confirm patch coverage against APSB25-19

How to Mitigate CVE-2025-27176

Immediate Actions Required

Update Adobe InDesign to the fixed releases listed in APSB25-19 on all Windows and macOS endpoints
Instruct users to avoid opening InDesign documents received from unverified senders until patching is complete
Scan shared design repositories for recently added .indd files from external contributors and quarantine suspicious items

Patch Information

Adobe published the fixed versions in security bulletin APSB25-19. Deploy the vendor-supplied updates through Adobe Creative Cloud Desktop or an enterprise software distribution tool. Confirm the installed build on each endpoint after deployment.

Workarounds

Restrict InDesign file ingestion to vetted internal sources until patches are applied across the environment
Open untrusted InDesign documents only in isolated virtual machines or dedicated sandbox hosts
Enforce email gateway policies that detonate or strip InDesign document attachments from external senders

bash

# Verify installed Adobe InDesign version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"

# Verify installed Adobe InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
  Select-Object DisplayName, DisplayVersion