CVE-2025-61801: Adobe Dimension RCE Vulnerability

CVE-2025-61801 Overview

CVE-2025-61801 is a Use After Free vulnerability [CWE-416] affecting Adobe Dimension versions 4.1.4 and earlier. The flaw can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file crafted by an attacker. The vulnerability impacts Adobe Dimension installations on both Microsoft Windows and Apple macOS platforms. Adobe addressed the issue in Security Advisory APSB25-103.

Critical Impact
Successful exploitation allows attackers to execute arbitrary code with the privileges of the logged-on user, potentially leading to full compromise of the affected workstation.

Affected Products

Adobe Dimension 4.1.4 and earlier
Apple macOS (Adobe Dimension installations)
Microsoft Windows (Adobe Dimension installations)

Discovery Timeline

2025-10-14 - CVE-2025-61801 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61801

Vulnerability Analysis

CVE-2025-61801 is a Use After Free condition in Adobe Dimension, a 3D rendering and design application. Use After Free [CWE-416] occurs when a program continues to reference memory after it has been freed. An attacker who controls the freed allocation can place attacker-controlled data at that address, leading to corrupted program state when the dangling pointer is dereferenced.

In the context of Adobe Dimension, the flaw is triggered during parsing or processing of a malicious file. When Dimension dereferences the stale pointer, control flow can be redirected to attacker-supplied data. The result is arbitrary code execution under the security context of the user running Dimension.

Root Cause

The root cause lies in improper memory lifecycle management within Dimension's file handling routines. An object is freed while another reference remains active. Subsequent operations on that reference operate on memory that may have been reallocated and populated with attacker-controlled content, enabling type confusion or direct hijack of object virtual tables.

Attack Vector

The attack vector is local and requires user interaction. An attacker must deliver a crafted Dimension project or asset file to the victim through email, web download, or shared storage. The victim must open the file in a vulnerable version of Dimension. No elevated privileges are required prior to exploitation, and successful exploitation yields code execution at the victim's privilege level.

No public proof-of-concept code is available for CVE-2025-61801. Refer to the Adobe Security Advisory APSB25-103 for vendor-provided technical context.

Detection Methods for CVE-2025-61801

Indicators of Compromise

Unexpected child processes spawned by Dimension.exe (Windows) or the Dimension application bundle (macOS), particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Crashes or abnormal terminations of Dimension immediately following the opening of an externally sourced project file.
Dimension processes performing outbound network connections to unfamiliar hosts after opening a document.
Creation of new executable files or scheduled tasks in user-writable directories shortly after a Dimension file is opened.

Detection Strategies

Inventory endpoints running Adobe Dimension and flag any installation at or below version 4.1.4.
Monitor process lineage for Dimension spawning scripting engines, LOLBins, or persistence-related binaries.
Apply behavioral detection rules for memory corruption patterns such as exception-based crashes followed by code execution attempts.
Inspect email and web download gateways for Dimension project files (.dn) originating from untrusted senders.

Monitoring Recommendations

Centralize endpoint process telemetry and file write events for forensic review of Dimension activity.
Alert on user-mode crashes of Dimension via Windows Error Reporting (WerFault) and macOS crash reports.
Track outbound network connections originating from Dimension processes against known-good baselines.

How to Mitigate CVE-2025-61801

Immediate Actions Required

Update Adobe Dimension to the fixed version identified in Adobe Security Advisory APSB25-103 on all Windows and macOS endpoints.
Instruct users not to open Dimension files received from untrusted or unverified sources until patching is complete.
Audit shared storage and collaboration platforms for unsolicited Dimension files and quarantine suspicious samples.

Patch Information

Adobe released a patched version of Dimension addressing CVE-2025-61801 as documented in Adobe Security Advisory APSB25-103. Apply the vendor update through the Adobe Creative Cloud desktop application or by downloading the updated installer from Adobe.

Workarounds

Block delivery of Dimension project files at email and web gateways for users who do not require them.
Restrict execution of Adobe Dimension via application allowlisting on endpoints where the software is not business-critical.
Run Dimension under standard user accounts only, ensuring no local administrator rights, to limit the impact of code execution.

bash

# Identify Adobe Dimension installations on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like "*Adobe Dimension*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation