BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-17

Assigner: Adobe Systems Incorporated

Description

Creative Cloud Desktop versions 6.7.0.278 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could lead to arbitrary file system write. A low-privileged attacker could exploit the timing between the check and use of a resource, potentially allowing unauthorized modifications to files. Exploitation of this issue does not require user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2025-10-17

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-54271

EUVD

EUVD-2025-34687

Affected Vendors & Products

Vendor	Product	Version / Range
adobe	creative_cloud	to 6.8.0.821 (exc)
apple	macos	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

Executive Summary

This vulnerability is a Time-of-check Time-of-use (TOCTOU) Race Condition in Creative Cloud Desktop versions 6.7.0.278 and earlier. It occurs because of a timing issue between checking a resource and using it, which a low-privileged attacker can exploit to write arbitrary files to the file system without requiring user interaction.

Impact Analysis

The vulnerability can allow a low-privileged attacker to modify files on the system without authorization, potentially leading to unauthorized changes or compromise of the system's integrity. Since exploitation does not require user interaction, it increases the risk of silent attacks.

Hi! I’m here to help you understand CVE-2025-54271. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70