CVE-2025-47104 Overview
Adobe InDesign Desktop contains an out-of-bounds read vulnerability affecting versions ID20.2, ID19.5.3, and earlier. The flaw allows disclosure of sensitive process memory when a user opens a maliciously crafted file. Attackers can leverage the leaked memory contents to bypass exploit mitigations such as Address Space Layout Randomization (ASLR), which typically serves as a foundation for chaining additional vulnerabilities into reliable code execution. The issue is tracked under CWE-125 (Out-of-Bounds Read) and requires local access with user interaction.
Critical Impact
Successful exploitation discloses process memory that undermines ASLR, enabling attackers to develop reliable exploits against InDesign on Windows and macOS.
Affected Products
- Adobe InDesign Desktop ID20.2 and earlier
- Adobe InDesign Desktop ID19.5.3 and earlier
- Microsoft Windows and Apple macOS installations of the affected InDesign versions
Discovery Timeline
- 2025-06-10 - CVE-2025-47104 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-47104
Vulnerability Analysis
The vulnerability is an out-of-bounds read in Adobe InDesign Desktop's file parsing logic. When InDesign processes a malformed document, the application reads memory beyond the bounds of an allocated buffer. That memory can contain sensitive runtime data, including pointers, heap addresses, and module base offsets.
An attacker who obtains these values can defeat ASLR, one of the primary mitigations that randomizes memory layout to complicate exploitation. Bypassing ASLR is often a prerequisite for chaining a separate memory corruption bug into arbitrary code execution.
The issue does not directly produce code execution or write access. Impact is limited to confidentiality, with no integrity or availability effects reported in the advisory.
Root Cause
The root cause is missing or insufficient bounds checking during the parsing of untrusted file content. When the parser dereferences an index or pointer derived from attacker-controlled data, it reads outside the intended buffer. This behavior corresponds to CWE-125.
Attack Vector
Exploitation requires local access and user interaction. A victim must open a malicious InDesign document delivered through email, a shared drive, a web download, or a supply chain vector. No elevated privileges are required to trigger the flaw. See the Adobe InDesign Security Advisory for vendor guidance and file format details.
Detection Methods for CVE-2025-47104
Indicators of Compromise
- Unexpected InDesign process crashes or unhandled exceptions during file open operations
- Delivery of .indd, .indt, or related InDesign document types from untrusted senders or unfamiliar external domains
- InDesign spawning child processes or performing outbound network activity shortly after opening a document
Detection Strategies
- Monitor endpoint telemetry for InDesign.exe (Windows) or the InDesign application bundle (macOS) generating access violations or segmentation faults
- Alert on InDesign reading files from download folders, email attachment cache paths, or removable media
- Correlate file open events with subsequent anomalous memory allocations or process behavior in EDR logs
Monitoring Recommendations
- Enforce logging of Adobe application crash reports and forward them to a central SIEM for analysis
- Track InDesign version inventory across managed endpoints to identify unpatched hosts
- Baseline normal InDesign process behavior so deviations tied to malicious document parsing are flagged
How to Mitigate CVE-2025-47104
Immediate Actions Required
- Update Adobe InDesign to the fixed versions identified in the Adobe InDesign Security Advisory APSB25-53
- Restrict opening of InDesign files received from untrusted or unverified sources
- Educate designers and production staff to validate document provenance before opening attachments
Patch Information
Adobe released fixed builds for InDesign Desktop as part of security bulletin APSB25-53. Administrators should deploy the updated versions through Adobe Creative Cloud or enterprise packaging tools. Refer to the Adobe InDesign Security Advisory for the exact patched version numbers and download instructions.
Workarounds
- Block or quarantine inbound InDesign document types at the email gateway when senders are unverified
- Run InDesign under a standard user account and apply application allowlisting to limit downstream impact
- Use a sandboxed or isolated workstation to open documents from untrusted external partners until patches are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
