CVE-2025-30321: Adobe InDesign NULL Pointer Dereference DoS

CVE-2025-30321 Overview

Adobe InDesign Desktop contains a null pointer dereference vulnerability [CWE-476] that leads to application denial of service. Adobe InDesign Desktop versions ID20.2, ID19.5.3, and earlier are affected across Windows and macOS platforms. An attacker can craft a malicious InDesign file that triggers a crash when opened by a victim. Exploitation requires user interaction, since the target must open the malicious document. The vulnerability does not enable code execution or data disclosure, but it disrupts availability of the design workflow.

Critical Impact
Opening a maliciously crafted InDesign file crashes the application, interrupting active work and potentially causing loss of unsaved content.

Affected Products

Adobe InDesign Desktop ID20.2 and earlier
Adobe InDesign Desktop ID19.5.3 and earlier
Adobe InDesign on Microsoft Windows and Apple macOS

Discovery Timeline

2025-06-10 - CVE-2025-30321 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30321

Vulnerability Analysis

The flaw is a null pointer dereference [CWE-476] in Adobe InDesign's file parsing logic. When InDesign processes a specifically malformed document, code paths dereference a pointer that was never initialized or was cleared during parsing. The dereference triggers an access violation, and the application terminates. The issue affects availability only. Confidentiality and integrity are not impacted, and no privileges are gained by the attacker. Because parsing occurs in the local process context, the attack vector is local and requires the victim to open the file.

Root Cause

Adobe's advisory identifies the defect as a null pointer dereference during document processing. The parser fails to validate that an internal object or structure pointer is non-null before accessing it. Malformed metadata, embedded objects, or structural elements in the InDesign file trigger the code path that reaches the unchecked dereference. See the Adobe Security Bulletin APSB25-53 for vendor details.

Attack Vector

Exploitation requires social engineering. An attacker delivers a crafted .indd file through email, shared storage, or a download link. When the victim opens the file in a vulnerable InDesign version, the process crashes. There is no network attack surface. The vulnerability cannot be triggered without user interaction, and it does not chain to code execution based on available data.

No public proof-of-concept exploits or in-the-wild exploitation have been reported. The EPSS probability is low.

Detection Methods for CVE-2025-30321

Indicators of Compromise

Unexpected Adobe InDesign (InDesign.exe on Windows, Adobe InDesign on macOS) process crashes correlated with opening third-party documents.
Windows Application event log entries with faulting module references tied to InDesign, or macOS crash reports in ~/Library/Logs/DiagnosticReports/ naming InDesign.
Delivery of .indd files from untrusted email senders or file-sharing links prior to a crash event.

Detection Strategies

Monitor endpoint telemetry for repeated abnormal terminations of InDesign processes across multiple users, which may indicate a shared malicious file.
Correlate email or web download events for .indd attachments with subsequent InDesign crash telemetry on the same host.
Track InDesign version inventory to identify hosts still running ID20.2, ID19.5.3, or earlier releases.

Monitoring Recommendations

Ingest Windows Application and macOS unified logs into a centralized SIEM to alert on InDesign crash patterns.
Alert on introduction of .indd files from external sources into shared collaboration platforms.
Track patch compliance for Adobe Creative Cloud applications against Adobe Security Bulletin APSB25-53.

How to Mitigate CVE-2025-30321

Immediate Actions Required

Update Adobe InDesign to the versions listed in Adobe Security Bulletin APSB25-53 on all Windows and macOS endpoints.
Instruct users to avoid opening .indd files received from untrusted or unverified sources.
Inventory endpoints running InDesign ID20.2, ID19.5.3, or earlier and prioritize them for patching.

Patch Information

Adobe released fixed versions of InDesign Desktop as documented in Adobe Security Bulletin APSB25-53. Administrators should deploy the update through Adobe Creative Cloud Desktop or an enterprise software distribution mechanism. Verify installed versions after deployment.

Workarounds

Restrict handling of untrusted .indd files to isolated or sandboxed workstations until patches are applied.
Enforce email attachment filtering to quarantine InDesign document types from external senders.
Enable frequent auto-save intervals in InDesign to limit data loss from unexpected crashes.

bash

# Verify installed Adobe InDesign version on macOS
defaults read "/Applications/Adobe InDesign 2025/Adobe InDesign 2025.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Adobe InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*InDesign*" } |
  Select-Object DisplayName, DisplayVersion