Adobe products vulnerable to arbitrary code execution
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple buffer overflow and integer underflow flaws in Adobe creative suite enable code execution; no active exploitation reported.
CIS has published advisory 2025-003 documenting 13 CVEs across seven Adobe products, the most severe of which permit arbitrary code execution in the context of the logged-on user. Affected products include Photoshop 2025 (26.1 and earlier) and 2024 (25.12 and earlier), Substance 3D Stager (3.0.4 and earlier), After Effects, Illustrator on iPad (3.0.7 and earlier), Animate 2023 (23.0.9 and earlier) and 2024 (24.0.6 and earlier), and Substance 3D Designer (14.0 and earlier). The vulnerabilities span uncontrolled search path elements, integer underflows, out-of-bounds reads and writes, stack-based buffer overflows, and heap-based buffer overflows—all executable via crafted input to the affected applications.
No active exploitation has been reported in the wild at the time of publication. Successful exploitation would grant the attacker the privileges of the logged-on user, potentially enabling installation of programs, modification or deletion of data, or creation of new accounts. Systems running these applications under non-administrative user contexts face lower risk. Adobe has released stable-channel updates; defenders should prioritize patching after testing, enforce least-privilege execution, and implement endpoint detection controls to detect abnormal behavior patterns from the affected applications.
Mentioned in this report
Detection guidance
Adobe Creative Application Spawning Script Interpreter or LOLBin
Adobe creative apps (Photoshop, Illustrator, Animate, After Effects, Substance 3D) spawning shells, script hosts or common LOLBins, a typical post-exploitation pattern after a malicious file triggers code execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Spawning Script Interpreter or LOLBin
id: 61c9faa3-b3d5-544d-98ae-939d340c2201
status: experimental
description: Detects Adobe creative applications (Photoshop, Illustrator, Animate,
After Effects, Substance 3D) spawning command shells, script hosts or common living-off-the-land
binaries. This is the typical post-exploitation behaviour after a crafted file exploits
a memory-corruption or search-path flaw in these apps. Based on the parent/child
relation rather than any specific CVE or sample.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Photoshop.exe
- \Illustrator.exe
- \Animate.exe
- \AfterFX.exe
- \Substance 3D Stager.exe
- \Adobe Substance 3D Designer.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection_parent and selection_child
falsepositives:
- Adobe extensions or plug-in installers that launch cmd.exe or msiexec.exe during
setup
- Studio automation scripts that call PowerShell or cmd from Photoshop or After Effects
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-003
Adobe Creative Application Launching Process From User-Writable Path
Adobe creative apps starting an executable located in temp, public, downloads or similar user-writable directories, suggesting a dropped payload after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Adobe Creative Application Launching Process From User-Writable Path
id: b16fece0-bcd7-54a3-8611-0c70398dcf1c
status: experimental
description: Detects Adobe creative applications (Photoshop, Illustrator, Animate,
After Effects, Substance 3D) launching a child process whose image is in a user-writable
location such as Temp, Users\Public, Downloads or ProgramData. This indicates a
payload dropped and executed via exploitation of the host application.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \Photoshop.exe
- \Illustrator.exe
- \Animate.exe
- \AfterFX.exe
- \Substance 3D Stager.exe
- \Adobe Substance 3D Designer.exe
selection_child:
Image|contains:
- \AppData\Local\Temp\
- \Users\Public\
- \Downloads\
- \ProgramData\
- \AppData\Roaming\
filter_adobe:
Image|contains: \Adobe\
condition: selection_parent and selection_child and not filter_adobe
falsepositives:
- Adobe or third-party updaters extracted to a temp folder and launched by the application
- Plug-in installers run from the Downloads folder via the app's extension manager
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-003
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-adobe-products-could-allow-for-arbitrary-code-execution_2025-003
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs