Multiple Adobe products vulnerable to arbitrary code execution

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Adobe patches critical memory corruption flaws across Acrobat, Illustrator, InDesign and Substance 3D suite; no active exploitation reported.

Sourcecisecurity.org — open the original

CIS released an advisory on March 11, 2025 covering multiple vulnerabilities across seven Adobe product lines. The most severe flaws are memory corruption issues—use-after-free, buffer overflows, out-of-bounds reads and writes, and null pointer dereferences—that could allow arbitrary code execution in the context of the logged-on user. Affected products include Acrobat and Reader (multiple versions), Adobe Illustrator, InDesign, and the Substance 3D suite (Sampler, Painter, Modeler, Designer). The advisory lists 40 CVEs across these products affecting older and current releases.

Exploitation would require a user to open a malicious file or interact with an attacker-controlled asset. Successful exploitation runs with user privileges; an attacker could install software, modify or delete data, or create new accounts depending on whether the user has administrative rights. CIS reports no evidence of in-the-wild exploitation at the time of publication. Adobe has released stable channel updates for all affected products, and CIS recommends immediate patching after testing, coupled with standard defensive practices: privilege restriction, application allowlisting, endpoint detection, and vulnerability management processes.

title: Adobe Acrobat or Reader Spawning Shell, Script Host or LOLBin
id: a1e31678-32d9-5ad7-83c2-05fbaba50031
status: experimental
description: Detects Adobe Acrobat or Reader starting a command interpreter, script
  host or common download/proxy-execution binary. After exploitation of memory corruption
  bugs (use-after-free, buffer overflow) in a malicious document, the payload commonly
  runs as a child of the reader process. Generalises on the parent/child relation,
  not on specific CVEs or file names.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-023
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AcroRd64.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msbuild.exe
    - \wmic.exe
  condition: selection
falsepositives:
- Legacy PDF workflows or plug-ins that call cmd.exe or a script host from Acrobat
- Document management integrations that launch helper scripts from Reader
level: high
author: Vorant

title: Adobe Creative Application Spawning Shell or Script Interpreter
id: c57b2643-24c5-583a-9992-475a97a91f07
status: experimental
description: Detects Adobe Illustrator, InDesign or Substance 3D applications (Sampler,
  Painter, Modeler, Designer) spawning a shell, script host or proxy-execution binary.
  Opening a crafted asset that triggers memory corruption can lead to code execution
  as the logged-on user, which usually appears as an unusual child process.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-023
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \Illustrator.exe
    - \InDesign.exe
    ParentImage|contains: \Adobe Substance 3D
  selection_parent_substance:
    ParentImage|contains: \Adobe Substance 3D
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: (selection_parent or selection_parent_substance) and selection_child
falsepositives:
- Studio pipeline scripts or plug-ins that call cmd.exe or PowerShell from Illustrator
  or InDesign
- Asset export automation in Substance 3D tools
level: medium
author: Vorant

title: Adobe Reader Child Process Executed from User-Writable Location
id: a0720f96-bc0f-5e7c-b8f6-804dfef75196
status: experimental
description: Detects Acrobat or Reader launching a child process whose image sits
  in a user-writable staging directory such as Temp, Public or Downloads. This suggests
  a payload dropped and run following exploitation of a malicious PDF.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-023
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \AcroRd32.exe
    - \Acrobat.exe
    - \AcroRd64.exe
    Image|contains:
    - \AppData\Local\Temp\
    - \Users\Public\
    - \Downloads\
    - \Windows\Temp\
  condition: selection
falsepositives:
- Installers or updaters launched from Reader that are extracted to a temp directory
- Opening an executable attachment embedded in a PDF by the user
level: high
author: Vorant

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-023

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.