CVE-2025-61815: Adobe InDesign RCE Vulnerability

CVE-2025-61815 Overview

CVE-2025-61815 is a Use After Free vulnerability [CWE-416] affecting Adobe InDesign Desktop versions 20.5, 19.5.5, and earlier on Windows and macOS. An attacker who crafts a malicious InDesign document can trigger arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically that a victim opens the malicious file. Adobe published the security advisory APSB25-106 addressing this issue.

Critical Impact
Successful exploitation results in arbitrary code execution under the privileges of the user opening the malicious InDesign file, potentially leading to full compromise of the user account on Windows or macOS hosts.

Affected Products

Adobe InDesign Desktop 20.5 and earlier
Adobe InDesign Desktop 19.5.5 and earlier
Microsoft Windows and Apple macOS platforms running affected InDesign versions

Discovery Timeline

2025-11-11 - CVE-2025-61815 published to NVD
2025-11-12 - Last updated in NVD database

Technical Details for CVE-2025-61815

Vulnerability Analysis

The flaw is a Use After Free condition [CWE-416] in Adobe InDesign Desktop. The application references a memory object after that object has already been freed. When the freed memory is later reallocated and populated with attacker-controlled data, the dangling reference enables an attacker to redirect execution flow.

Because InDesign processes complex document structures with embedded objects, fonts, and graphics, a maliciously crafted file can manipulate object lifetimes during parsing. The resulting memory corruption gives an attacker a path to arbitrary code execution within the InDesign process. Code runs with the same privileges as the user opening the file, which on workstation deployments commonly includes access to user documents, network shares, and credentials.

Root Cause

The vulnerability stems from improper management of object lifetimes inside InDesign's document parsing logic. A pointer remains active after the underlying memory has been released, violating safe memory access invariants. Adobe has not disclosed the specific component or function involved beyond the advisory in APSB25-106.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a crafted InDesign file through phishing email, file sharing services, or a compromised website. When the victim opens the file in a vulnerable version of InDesign, the parser dereferences freed memory and executes attacker-controlled code. No elevated privileges are needed prior to exploitation.

For technical details, refer to the Adobe InDesign Security Advisory APSB25-106.

Detection Methods for CVE-2025-61815

Indicators of Compromise

Unexpected child processes spawned by InDesign.exe on Windows or Adobe InDesign on macOS, particularly shells, scripting interpreters, or rundll32.exe.
InDesign process crashes followed by anomalous network connections to external hosts.
InDesign files (.indd, .indt, .idml) received from untrusted sources or delivered through phishing email.
New persistence artifacts, scheduled tasks, or LaunchAgents created shortly after a user opens an InDesign document.

Detection Strategies

Monitor process lineage for InDesign spawning command interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Inspect endpoint telemetry for memory access violations or crash events generated by InDesign, which may indicate exploitation attempts.
Apply email gateway rules to flag or sandbox inbound InDesign file attachments from external senders.

Monitoring Recommendations

Track InDesign software versions across managed endpoints to identify hosts still running 20.5, 19.5.5, or earlier.
Alert on outbound network connections initiated by InDesign processes, which is atypical behavior for document editing software.
Correlate file write events under user profile directories with subsequent execution of binaries dropped by InDesign.

How to Mitigate CVE-2025-61815

Immediate Actions Required

Apply the Adobe updates referenced in APSB25-106 to all InDesign installations.
Inventory endpoints running InDesign 20.5, 19.5.5, or earlier and prioritize patch deployment.
Instruct users not to open InDesign files received from untrusted or unexpected sources until patching is complete.

Patch Information

Adobe released fixed versions of InDesign Desktop addressing CVE-2025-61815. Patch details and download links are available in the Adobe InDesign Security Advisory APSB25-106. Administrators should deploy updates through the Adobe Creative Cloud desktop application or enterprise update channels.

Workarounds

Restrict opening of InDesign documents to files received from trusted internal sources until patches are deployed.
Use application allowlisting to prevent unexpected child processes from being spawned by InDesign.
Apply email filtering rules to quarantine InDesign attachments originating from external domains.

bash

# Verify installed Adobe InDesign version on macOS
mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"

# Verify installed Adobe InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*InDesign*" } |
  Select-Object DisplayName, DisplayVersion