CVE-2025-61845: Adobe Format Plugins Information Disclosure

CVE-2025-61845 Overview

CVE-2025-61845 is an out-of-bounds read vulnerability affecting Adobe Format Plugins versions 1.1.1 and earlier. The flaw allows an attacker to read memory outside the intended buffer boundary, potentially exposing sensitive information stored in process memory. Exploitation requires user interaction: a victim must open a malicious file crafted to trigger the out-of-bounds condition. The vulnerability is categorized under [CWE-125] (Out-of-bounds Read). Adobe addressed the issue in Security Bulletin APSB25-114.

Critical Impact
Successful exploitation discloses sensitive data from memory, which attackers can use to bypass security mitigations or harvest credentials and tokens residing in the plugin's process space.

Affected Products

Adobe Format Plugins version 1.1.1
Adobe Format Plugins versions prior to 1.1.1
Host applications loading vulnerable Format Plugins components

Discovery Timeline

2025-11-11 - CVE-2025-61845 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-61845

Vulnerability Analysis

The vulnerability resides in Adobe Format Plugins, a component used to parse and process file formats within Adobe applications. When the plugin processes a specially crafted input file, it reads data beyond the bounds of an allocated buffer. This out-of-bounds read exposes adjacent memory contents to the attacker.

The issue is a local attack vector requiring user interaction. An attacker delivers a malicious file through email, web download, or file sharing. When the victim opens the file with a vulnerable Adobe application, the plugin dereferences memory outside the intended range and returns that data to the attacker's controlled parsing context.

Memory disclosure vulnerabilities of this class weaken address space layout randomization (ASLR) and can leak secrets held in the process, including session tokens, decrypted content, or pointers useful for chaining with code execution flaws.

Root Cause

The root cause is missing or incorrect bounds validation during file parsing. The plugin computes a read offset or length from untrusted file data without verifying that the resulting access remains within the allocated buffer. This corresponds to [CWE-125], Out-of-bounds Read.

Attack Vector

Exploitation requires local file access combined with user interaction. The attacker crafts a malformed file that manipulates size or offset fields consumed by the format parser. Delivery typically occurs through phishing, malicious document repositories, or drive-by downloads. Upon opening the file, the plugin performs the invalid read and the leaked memory can be exfiltrated through subsequent plugin behavior.

The vulnerability does not, by itself, grant code execution. However, disclosed memory can be combined with a separate write or execution primitive to achieve reliable exploitation.

No public proof-of-concept exploit is currently listed for CVE-2025-61845, and it is not tracked on the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Security Bulletin APSB25-114 for vendor technical details.

Detection Methods for CVE-2025-61845

Indicators of Compromise

Malformed files targeting Adobe Format Plugins with abnormal header size or offset fields inconsistent with declared content length
Adobe application process crashes or memory access violations correlated with opening third-party files
Unexpected outbound network activity from Adobe application processes shortly after a document is opened

Detection Strategies

Inspect email attachments and downloaded files for format anomalies using content-disarm-and-reconstruction or sandbox detonation before delivery to users
Enable process telemetry on endpoints to capture Adobe plugin load events and correlate them with file-open activity from untrusted sources
Use file reputation services to flag files sourced from external senders or unmanaged storage locations before opening

Monitoring Recommendations

Track version inventory of Adobe Format Plugins across managed endpoints and alert on hosts running 1.1.1 or earlier
Monitor Windows Error Reporting and macOS crash logs for faults inside Format Plugin modules
Aggregate endpoint logs into a central data lake to correlate file-open events, plugin loads, and subsequent process behavior

How to Mitigate CVE-2025-61845

Immediate Actions Required

Apply the fixed version of Adobe Format Plugins as identified in Adobe Security Bulletin APSB25-114
Restrict opening of untrusted files from email, web, or removable media until patches are deployed
Enforce least-privilege user accounts to limit the scope of any information disclosure

Patch Information

Adobe published Security Bulletin APSB25-114 addressing this out-of-bounds read in Format Plugins. Administrators should update all installations of Format Plugins to a version later than 1.1.1. Consult the vendor advisory for the specific fixed release and installation instructions.

Workarounds

Disable or remove the Format Plugins component in environments where the file formats it processes are not required
Use application allowlisting to prevent Adobe applications from loading unapproved or outdated plugin versions
Route inbound files through a sandbox or file conversion gateway that renders content in a safe format before delivery

bash

# Example: enumerate Adobe Format Plugins version on Windows endpoints
Get-ChildItem -Path 'C:\Program Files\Adobe' -Recurse -Filter '*FormatPlugin*' |
  ForEach-Object { (Get-Item $_.FullName).VersionInfo | Select-Object FileName, FileVersion }