CVE-2025-47105: Adobe InDesign Information Disclosure Flaw

CVE-2025-47105 Overview

Adobe InDesign Desktop contains an out-of-bounds read vulnerability [CWE-125] that can disclose sensitive process memory. The flaw affects InDesign Desktop versions ID20.2, ID19.5.3, and earlier on Windows and macOS. An attacker who convinces a user to open a crafted file can read memory outside intended buffer boundaries. The disclosed data can defeat Address Space Layout Randomization (ASLR) and enable follow-on exploitation of other memory corruption bugs. Exploitation requires local user interaction and does not grant code execution on its own.

Critical Impact
Memory disclosure enables ASLR bypass, lowering the barrier to chaining additional exploits for remote code execution.

Affected Products

Adobe InDesign Desktop ID20.2 and earlier
Adobe InDesign Desktop ID19.5.3 and earlier
Microsoft Windows and Apple macOS installations of the affected versions

Discovery Timeline

2025-06-10 - CVE-2025-47105 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47105

Vulnerability Analysis

The vulnerability is an out-of-bounds read in InDesign Desktop's file parsing logic. When InDesign processes a malformed document, the parser reads beyond the bounds of an allocated buffer. The read operation returns adjacent heap or stack memory to attacker-controlled code paths within the file format.

An attacker can shape the input so that the leaked bytes contain pointers, module base addresses, or other sensitive state. This information defeats ASLR by revealing where executable modules load in memory. Combined with a separate write primitive, the leak accelerates reliable exploit development against InDesign on both Windows and macOS.

The issue does not corrupt memory directly and does not modify application state. Impact is confined to confidentiality of in-process memory, which aligns with the CVSS confidentiality-only impact scoring.

Root Cause

The root cause is missing or incorrect bounds validation during parsing of a specific element inside an InDesign document. The parser trusts a size or offset field embedded in the file and dereferences memory without verifying that the computed index remains inside the allocated buffer.

Attack Vector

Exploitation is local and requires user interaction. The attacker delivers a malicious .indd or related InDesign file through email, a shared drive, or a download. The victim opens the file in a vulnerable InDesign Desktop build, triggering the out-of-bounds read during document load or render. No network access to the host is required.

The vulnerability mechanism is described in prose because no verified public proof-of-concept is available. See the Adobe InDesign Security Advisory for vendor technical details.

Detection Methods for CVE-2025-47105

Indicators of Compromise

Unexpected InDesign .indd, .idml, or template files arriving via email or external file shares from untrusted senders
InDesign process crashes, hangs, or abnormal memory read exceptions logged shortly after a document open event
Child processes spawned by InDesign.exe that are not part of normal plugin or scripting workflows

Detection Strategies

Monitor endpoint telemetry for InDesign opening files from browser download folders, email attachment caches, or removable media
Correlate document open events with subsequent anomalous memory access violations in Windows Event Logs or macOS crash reports
Apply YARA or file-type inspection at the mail and web gateway to flag malformed InDesign files with unusual embedded structures

Monitoring Recommendations

Track InDesign Desktop version inventory across managed endpoints and alert on hosts running builds at or below ID20.2 and ID19.5.3
Enable detailed process and file telemetry on creative workstations, which are often outside standard endpoint monitoring scope
Review DLP logs for sensitive memory artifacts being exfiltrated after suspected InDesign exploitation

How to Mitigate CVE-2025-47105

Immediate Actions Required

Upgrade Adobe InDesign Desktop to the fixed releases listed in Adobe security bulletin APSB25-53 on all Windows and macOS endpoints
Instruct users to open InDesign files only from verified internal sources until patching completes
Prioritize patching for creative, marketing, and prepress teams whose workstations routinely receive external InDesign files

Patch Information

Adobe addressed the vulnerability in updated InDesign Desktop builds published in the Adobe InDesign Security Advisory APSB25-53. Deploy the vendor-supplied updates through the Adobe Creative Cloud desktop application or your managed software distribution system.

Workarounds

Block or quarantine InDesign document attachments at the email gateway when they originate from untrusted senders
Open suspect InDesign files in an isolated virtual machine or sandbox without access to sensitive data
Apply application allowlisting to prevent InDesign from launching unexpected child processes that could stage follow-on payloads

bash

# Query installed InDesign version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate