CVE-2025-30319: Adobe InDesign NULL Pointer DOS Vulnerability

CVE-2025-30319 Overview

CVE-2025-30319 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe InDesign Desktop versions ID19.5.2, ID20.2, and earlier releases on both Microsoft Windows and Apple macOS. The flaw enables an attacker to trigger an application crash, producing a denial-of-service condition in the InDesign process. Exploitation requires user interaction: the victim must open a crafted malicious file in the affected application. Adobe published a fix in security bulletin APSB25-37.

Critical Impact
Successful exploitation crashes Adobe InDesign, causing loss of unsaved work and disruption to publishing workflows. The issue is scoped to availability and does not grant code execution or data disclosure.

Affected Products

Adobe InDesign Desktop ID19.5.2 and earlier ID19.x releases
Adobe InDesign Desktop ID20.2 and earlier ID20.x releases
Deployments on Microsoft Windows and Apple macOS

Discovery Timeline

2025-05-13 - CVE-2025-30319 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30319

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] within the Adobe InDesign document parser. When InDesign processes a specially crafted file, an internal code path accesses a pointer that has not been initialized or has been set to null. Dereferencing that pointer causes the process to crash, terminating the current editing session.

The issue is local in nature. An attacker cannot reach the vulnerable parsing routine over the network without first delivering a malicious document to the user. The impact is limited to availability: confidentiality and integrity are not affected because the crash occurs before any attacker-controlled logic executes.

The Adobe security bulletin APSB25-37 addresses this issue alongside other InDesign vulnerabilities disclosed in the same update cycle. EPSS scoring places real-world exploitation probability in the lower range for 2026.

Root Cause

The root cause is missing validation of a pointer returned during file parsing. The affected code path assumes a non-null result from an internal allocation or lookup routine and proceeds to dereference the returned pointer. Malformed structural fields in a crafted InDesign document cause that routine to return null, triggering the fault.

Attack Vector

Exploitation follows a file-based social engineering pattern. An attacker crafts a malicious InDesign document, typically an .indd, .indt, or related project file, and delivers it through email, shared storage, or a download link. When the victim opens the file in a vulnerable InDesign build, the parser reaches the unvalidated pointer and the application crashes. No elevated privileges or network access are required by the attacker.

Refer to the Adobe InDesign Security Update APSB25-37 for authoritative technical details.

Detection Methods for CVE-2025-30319

Indicators of Compromise

Unexpected termination of InDesign.exe (Windows) or the Adobe InDesign process (macOS) shortly after a document open event.
Windows Application Error events (Event ID 1000) or macOS crash reports referencing InDesign with an access-violation signature at a null address.
Inbound InDesign documents from untrusted senders, especially files that consistently crash the application on open.

Detection Strategies

Monitor endpoint telemetry for repeated InDesign process crashes tied to specific document hashes or delivery channels.
Correlate email or file-share delivery of .indd/.indt files with subsequent application faults on the same host.
Track InDesign version inventory against fixed releases listed in APSB25-37 to identify exposed endpoints.

Monitoring Recommendations

Ingest Windows Error Reporting and macOS ReportCrash data into a centralized log platform for InDesign fault analysis.
Alert on clusters of InDesign crashes across multiple users that share a common source document.
Include Adobe Creative Cloud application versions in software asset reports for patch compliance reviews.

How to Mitigate CVE-2025-30319

Immediate Actions Required

Update Adobe InDesign to the fixed versions listed in Adobe security bulletin APSB25-37 on all Windows and macOS endpoints.
Instruct users to avoid opening InDesign documents received from untrusted or unverified sources.
Prioritize patching for users who routinely receive external design files, such as prepress, marketing, and agency teams.

Patch Information

Adobe released fixed builds for InDesign 19.x and 20.x through the Creative Cloud desktop application. Administrators should consult the Adobe InDesign Security Update APSB25-37 for the exact fixed version numbers and deployment guidance. Enterprise deployments using the Adobe Admin Console should push the updated package to managed endpoints.

Workarounds

Restrict opening of InDesign documents originating from external email or unmanaged file shares until endpoints are patched.
Preview suspicious files in isolated or virtualized environments rather than production workstations.
Enforce Adobe Creative Cloud auto-update policies through the Adobe Admin Console to reduce version drift.

bash

# Verify installed Adobe InDesign version on macOS
defaults read "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Adobe InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
  Select-Object DisplayName, DisplayVersion