PostHole
Compose Login
You are browsing eu.zone1 in read-only mode. Log in to participate.
rss-bridge 2025-12-09T19:09:58+00:00

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

Adobe ColdFusion is a rapid web application development platform that uses the ColdFusion Markup Language (CFML).Adobe Experience Manager (AEM) is a content management and experience management system that helps businesses build and manage their digital presence across various platforms.The Adobe DNG Software Development Kit (SDK) is a free set of tools and code from Adobe that helps developers add support for Adobe's Digital Negative (DNG) universal RAW file format into their own applications and cameras, enabling them to read, write, and process DNG images, solving workflow issues and improving archiving for digital photos.Adobe Acrobat is a suite of paid tools for creating, editing, converting, and managing PDF documents.The Adobe Creative Cloud desktop app is the central hub for managing all Adobe creative applications, files, and assets.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Multiple Vulnerabilities in Adobe Products Could Allow for Arbitrary Code Execution

MS-ISAC ADVISORY NUMBER:

2025-114

DATE(S) ISSUED:

12/09/2025

OVERVIEW:

Multiple vulnerabilities have been discovered in Adobe products, the most severe of which could allow for arbitrary code execution.

  • Adobe ColdFusion is a rapid web application development platform that uses the ColdFusion Markup Language (CFML).
  • Adobe Experience Manager (AEM) is a content management and experience management system that helps businesses build and manage their digital presence across various platforms.
  • The Adobe DNG Software Development Kit (SDK) is a free set of tools and code from Adobe that helps developers add support for Adobe's Digital Negative (DNG) universal RAW file format into their own applications and cameras, enabling them to read, write, and process DNG images, solving workflow issues and improving archiving for digital photos.
  • Adobe Acrobat is a suite of paid tools for creating, editing, converting, and managing PDF documents.
  • The Adobe Creative Cloud desktop app is the central hub for managing all Adobe creative applications, files, and assets.

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

THREAT INTELLIGENCE:

There are currently no reports of these vulnerabilities being exploited in the wild.

SYSTEMS AFFECTED:

  • Creative Cloud Desktop Application 6.4.0.361 and earlier versions
  • ColdFusion 2025 Update 4 and earlier versions
  • ColdFusion 2023 Update 16 and earlier versions
  • ColdFusion 2021 Update 22 and earlier versions
  • Adobe Experience Manager (AEM) AEM Cloud Service Release 2025.12
  • Adobe Experience Manager (AEM) 6.5 LTS SP1 (GRANITE-61551 Hotfix)
  • Adobe Experience Manager (AEM) 6.5.24
  • AEM Cloud Service (CS) 6.5 LTS
  • AEM Cloud Service (CS) 6.5 6.5.23 and earlier versions
  • Adobe DNG Software Development Kit (SDK) DNG SDK 1.7.0 and earlier versions
  • Acrobat DC 25.001.20982 and earlier versions
  • Acrobat Reader DC 25.001.20982 and earlier versions
  • Acrobat 2024 24.001.30264 and earlier versions for Windows, 24.001.30273 and earlier versions for MAC
  • Acrobat 2020 20.005.30793 and earlier versions for Windows, 20.005.30803 and earlier versions for MAC
  • Acrobat Reader 2020 20.005.30793 and earlier versions for Windows, 0.005.30803 and earlier versions for MAC

RISK:

Government:

Large and medium government entitiesHIGH

Small governmentMEDIUM

Businesses:

Large and medium business entitiesHIGH

Small business entitiesMEDIUM

Home Users:

LOW

TECHNICAL SUMMARY:

Adobe ColdFusion:

  • Unrestricted Upload of File with Dangerous Type (CVE-2025-61808)
  • Improper Input Validation (CVE-2025-61809, CVE-2025-61812, CVE-2025-61822)
  • Deserialization of Untrusted Data (CVE-2025-61830, CVE-2025-61810)
  • Improper Access Control (CVE-2025-61811, CVE-2025-64897)
  • Improper Restriction of XML External Entity Reference ('XXE') (CVE-2025-61813, CVE-2025-61821, CVE-2025-61823)
  • Insufficiently Protected Credentials (CVE-2025-64898)

Adobe Experience Manager:

  • Cross-site Scripting (DOM-based XSS) (CVE-2025-64537, CVE-2025-64539, CVE-2025-64540, CVE-2025-64542, CVE-2025-64543, CVE-2025-64544, CVE-2025-64545, CVE-2025-64550, CVE-2025-64551, CVE-2025-64560, CVE-2025-64562, CVE-2025-64563, CVE-2025-64564, CVE-2025-64565, CVE-2025-64569, CVE-2025-64583, CVE-2025-64887, CVE-2025-64888)
  • Cross-site Scripting (Stored XSS) (CVE-2025-64541, CVE-2025-64546, CVE-2025-64547, CVE-2025-64548, CVE-2025-64549, CVE-2025-64552, CVE-2025-64553, CVE-2025-64554, CVE-2025-64555, CVE-2025-64556, CVE-2025-64557, CVE-2025-64558, CVE-2025-64559, CVE-2025-64572, CVE-2025-64574, CVE-2025-64575, CVE-2025-64576, CVE-2025-64577, CVE-2025-64578, CVE-2025-64579, CVE-2025-64580, CVE-2025-64581, CVE-2025-64582, CVE-2025-64585, CVE-2025-64586, CVE-2025-64590, CVE-2025-64591, CVE-2025-64592, CVE-2025-64593, CVE-2025-64594, CVE-2025-64596, CVE-2025-64597, CVE-2025-64598, CVE-2025-64599, CVE-2025-64600, CVE-2025-64601, CVE-2025-64602, CVE-2025-64603, CVE-2025-64604, CVE-2025-64605, CVE-2025-64606, CVE-2025-64607, CVE-2025-64609, CVE-2025-64610, CVE-2025-64611, CVE-2025-64612, CVE-2025-64614, CVE-2025-64615, CVE-2025-64616, CVE-2025-64619, CVE-2025-64620, CVE-2025-64622, CVE-2025-64623, CVE-2025-64626, CVE-2025-64627, CVE-2025-64789, CVE-2025-64790, CVE-2025-64791, CVE-2025-64792, CVE-2025-64793, CVE-2025-64794, CVE-2025-64796, CVE-2025-64797, CVE-2025-64799, CVE-2025-64800, CVE-2025-64801, CVE-2025-64802, CVE-2025-64803, CVE-2025-64804, CVE-2025-64808, CVE-2025-64814, CVE-2025-64817, CVE-2025-64820, CVE-2025-64821, CVE-2025-64822, CVE-2025-64823, CVE-2025-64825, CVE-2025-64826, CVE-2025-64827, CVE-2025-64829, CVE-2025-64833, CVE-2025-64839, CVE-2025-64840, CVE-2025-64841, CVE-2025-64845, CVE-2025-64847, CVE-2025-64850, CVE-2025-64852, CVE-2025-64853, CVE-2025-64857, CVE-2025-64858, CVE-2025-64860, CVE-2025-64861, CVE-2025-64863, CVE-2025-64869, CVE-2025-64872, CVE-2025-64873, CVE-2025-64875, CVE-2025-64881)

Adobe DNG Software Development Kit (SDK):

  • Integer Overflow or Wraparound (CVE-2025-64783)
  • Heap-based Buffer Overflow (CVE-2025-64784)
  • Out-of-bounds Read (CVE-2025-64893)
  • Integer Overflow or Wraparound (CVE-2025-64894)

Adobe Acrobat and Reader:

  • Untrusted Search Path (CVE-2025-64785)
  • Out-of-bounds Read (CVE-2025-64899)
  • Improper Verification of Cryptographic Signature (CVE-2025-64786, CVE-2025-64787)

Adobe Creative Cloud Desktop Application:

  • Creation of Temporary File in Directory with Incorrect Permissions (CVE-2025-64896)

Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution in the context of the logged on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

RECOMMENDATIONS:

We recommend the following actions be taken:

  • Apply the stable channel update provided by Adobe to vulnerable systems immediately after appropriate testing. (M1051: Update Software)
  • Safeguard 7.1: Establish and Maintain a Vulnerability Management Process: Establish and maintain a documented vulnerability management process for enterprise assets. Review and update documentation annually, or when significant enterprise changes occur that could impact this Safeguard.
  • Safeguard 7.2: Establish and Maintain a Remediation Process: Establish and maintain a risk-based remediation strategy documented in a remediation process, with monthly, or more frequent, reviews.
  • Safeguard 7.6: Perform Automated Vulnerability Scans of Externally-Exposed Enterprise Assets: Perform automated vulnerability scans of externally-exposed enterprise assets using a SCAP-compliant vulnerability scanning tool. Perform scans on a monthly, or more frequent, basis.
  • Safeguard 7.7: Remediate Detected Vulnerabilities: Remediate detected vulnerabilities in software through processes and tooling on a monthly, or more frequent, basis, based on the remediation process.

[...]

Original source

Reply