CVE-2025-27179: Adobe InDesign NULL Pointer Dereference DOS

CVE-2025-27179 Overview

CVE-2025-27179 is a NULL Pointer Dereference vulnerability [CWE-476] in Adobe InDesign Desktop. The flaw affects InDesign Desktop versions ID20.1, ID19.5.2, and earlier releases on both Windows and macOS platforms. An attacker can trigger an application crash by convincing a victim to open a malicious InDesign file. Exploitation produces a denial-of-service condition in the desktop application. The attack vector is local and requires user interaction, which limits large-scale exploitation.

Critical Impact
Successful exploitation crashes the Adobe InDesign application, disrupting document workflows and potentially causing loss of unsaved work for designers and publishers.

Affected Products

Adobe InDesign Desktop ID20.1 and earlier
Adobe InDesign Desktop ID19.5.2 and earlier
Apple macOS and Microsoft Windows installations running affected InDesign builds

Discovery Timeline

2025-03-11 - CVE-2025-27179 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27179

Vulnerability Analysis

The vulnerability resides in Adobe InDesign's file parsing logic. When InDesign processes a crafted document, a code path dereferences a pointer without first validating that the pointer is non-null. The dereference triggers an access violation, which terminates the process.

The issue is scoped to availability. The CVSS vector indicates no impact to confidentiality or integrity, consistent with a denial-of-service outcome rather than code execution. Because exploitation requires a user to open a malicious file locally, the attacker needs a delivery mechanism such as email, shared file storage, or a compromised asset library.

Root Cause

The root cause is a missing null check [CWE-476] in a parsing routine that handles untrusted document content. When a malformed structure causes an internal allocation or lookup to return a null reference, subsequent code accesses a member or method through that null pointer. The resulting fault is unrecoverable within the application process.

Attack Vector

An attacker crafts a malicious InDesign document and delivers it to a target user. The user must open the file in a vulnerable InDesign build on Windows or macOS. No elevated privileges or network access are required. The attack cannot be chained to remote code execution based on the published CVSS impact metrics. Refer to the Adobe InDesign Security Advisory APSB25-19 for vendor technical details.

Detection Methods for CVE-2025-27179

Indicators of Compromise

Unexpected termination of the InDesign.exe process (Windows) or Adobe InDesign process (macOS) shortly after opening an .indd, .idml, or related document.
Windows Application Event Log entries referencing Application Error source with InDesign.exe and a faulting module tied to access violations (exception code 0xC0000005).
macOS crash reports in ~/Library/Logs/DiagnosticReports/ naming Adobe InDesign with an EXC_BAD_ACCESS signal.
Delivery of InDesign files from untrusted sources, including external email attachments and unfamiliar cloud shares.

Detection Strategies

Correlate repeated InDesign process crashes across multiple users with recently received document attachments to identify a weaponized file in circulation.
Hunt for InDesign document files originating from external senders or newly introduced to shared creative asset repositories.
Monitor endpoint telemetry for abnormal child process behavior or crash loops tied to InDesign binaries.

Monitoring Recommendations

Enable centralized collection of Windows Application Event Logs and macOS crash reports from endpoints running InDesign.
Track InDesign version inventory across managed endpoints to confirm patch coverage against ID20.1 and ID19.5.2.
Alert on bulk distribution of InDesign file types through email gateways and collaboration platforms.

How to Mitigate CVE-2025-27179

Immediate Actions Required

Apply the Adobe security updates referenced in APSB25-19 to all endpoints running Adobe InDesign.
Inventory InDesign installations and prioritize upgrades for creative teams that routinely receive external documents.
Instruct users to avoid opening unsolicited InDesign files and to validate the sender before opening attachments.

Patch Information

Adobe addressed CVE-2025-27179 in the updates documented in security bulletin APSB25-19. Administrators should deploy the fixed builds for both the InDesign 20.x and InDesign 19.x maintenance branches on Windows and macOS. Verify installed versions through Adobe Creative Cloud or the Help menu after update.

Workarounds

Restrict opening of InDesign documents to files sourced from trusted internal repositories until patches are deployed.
Use email and web gateway rules to quarantine InDesign file types originating from external senders for inspection.
Enable auto-save intervals in InDesign to reduce the impact of unexpected application termination on in-progress work.

bash

# Example: Query installed Adobe InDesign version on Windows endpoints
reg query "HKLM\SOFTWARE\Adobe\InDesign" /s /v Version

# Example: Query installed Adobe InDesign version on macOS endpoints
mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"