CVE-2025-47099: Adobe InCopy Buffer Overflow Vulnerability

CVE-2025-47099 Overview

CVE-2025-47099 is a heap-based buffer overflow vulnerability [CWE-122] affecting Adobe InCopy versions 20.3, 19.5.3, and earlier. Successful exploitation enables arbitrary code execution in the context of the current user. The flaw resides in InCopy's file parsing routines and triggers when the application processes a malicious document. Exploitation requires user interaction, as a victim must open a crafted file delivered through email, web download, or shared storage. Adobe assigned this issue under security bulletin APSB25-59 and released patched builds for both Windows and macOS.

Critical Impact
Arbitrary code execution under the current user's privileges through a single malicious InCopy document, enabling endpoint compromise without elevated permissions.

Affected Products

Adobe InCopy 20.3 and earlier (20.x branch)
Adobe InCopy 19.5.3 and earlier (19.x branch)
Deployments on Microsoft Windows and Apple macOS

Discovery Timeline

2025-07-08 - CVE-2025-47099 published to NVD
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-47099

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow classified under [CWE-122]. Adobe InCopy fails to validate the size of attacker-controlled data before writing it to a heap-allocated buffer during document parsing. When the application processes a malformed file structure, the write operation extends beyond the allocated region and corrupts adjacent heap metadata or object pointers.

An attacker who controls the layout of the corrupted heap region can redirect execution flow. Successful exploitation yields arbitrary code execution within the security context of the user running InCopy. Because InCopy typically runs with standard user rights, the attacker inherits those permissions rather than SYSTEM or root. The attack vector is local and requires user interaction, which limits mass exploitation but remains effective in targeted spear-phishing campaigns.

Root Cause

The root cause is missing or inadequate bounds checking in a file-format parser within InCopy. The application allocates a heap buffer based on one field while copying data sized by another field, or fails to cap the copy length against the destination size. Adobe's advisory APSB25-59 documents the affected components but does not publicly attribute the specific parser routine.

Attack Vector

The attacker crafts a malicious InCopy document (such as .icml, .incx, or related supported formats) and delivers it through email attachments, file shares, or web downloads. When the victim opens the file in a vulnerable version of InCopy, the parser triggers the overflow and executes attacker-supplied code. No network access to the victim host is required, and no prior authentication on the target system is needed.

No verified proof-of-concept exploit code is publicly available. See the Adobe InCopy Security Advisory APSB25-59 for vendor-confirmed technical details.

Detection Methods for CVE-2025-47099

Indicators of Compromise

Unexpected child processes spawned by InCopy.exe (Windows) or the Adobe InCopy process (macOS), particularly shells, scripting engines, or rundll32.exe.
InCopy process crashes or anomalous exception events in Windows Event Logs or macOS crash reports correlated with opening untrusted documents.
InCopy initiating outbound network connections to unrecognized hosts shortly after document open.
Unsolicited inbound emails containing InCopy file attachments such as .icml or .incx from external senders.

Detection Strategies

Deploy behavioral endpoint detection rules that flag office and creative-suite applications spawning command interpreters or performing process injection.
Inspect email gateways and web proxies for InCopy file formats originating from untrusted sources, and detonate suspicious samples in sandboxes.
Monitor for memory-corruption telemetry such as heap corruption exceptions and access violations within Adobe processes.

Monitoring Recommendations

Centralize Adobe application crash telemetry and EDR process-tree events into a SIEM for correlation against threat intelligence on Adobe-targeting campaigns.
Track installed InCopy versions across the fleet and alert when hosts run versions at or below 20.3 or 19.5.3.
Enable PowerShell and shell command logging on workstations used by editorial and creative teams to capture post-exploitation activity.

How to Mitigate CVE-2025-47099

Immediate Actions Required

Apply the Adobe-supplied patched versions of InCopy on every Windows and macOS host running the application.
Inventory all systems with InCopy installed and prioritize patching for users who routinely open externally sourced documents.
Instruct users not to open InCopy files from unverified email senders, instant messages, or untrusted websites until patches are deployed.

Patch Information

Adobe released fixed versions of InCopy addressing CVE-2025-47099 as part of security bulletin APSB25-59. Refer to the Adobe InCopy Security Advisory for exact fixed version numbers and download links for Windows and macOS installers. Apply updates through Adobe Creative Cloud Desktop or enterprise deployment tooling.

Workarounds

Restrict InCopy file types at email and web gateways for users who do not require external document collaboration.
Open documents from untrusted sources only inside isolated virtual machines or dedicated sandboxed accounts with no access to sensitive resources.
Enforce least-privilege user accounts so any code executed through InCopy inherits minimal permissions and cannot escalate easily.

bash

# Verify installed Adobe InCopy version on macOS
defaults read "/Applications/Adobe InCopy 2024/Adobe InCopy 2024.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Adobe InCopy version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*InCopy*" } |
  Select-Object DisplayName, DisplayVersion