CVE-2025-64896 Creative Cloud Desktop | Creation of Temporary File in Directory with Incorrect Permissions (CWE-379)

Medium 5.5 Published 9 Dec 2025 Updated 9 Dec 2025

An attacker can cause denial of service in Adobe Creative Cloud Desktop by manipulating temporary files, requiring user interaction to open a malicious file.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-64896?

CVE-2025-64896 is a medium-severity vulnerability in Adobe Creative Cloud Desktop, published on 9 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to disrupt the application's functionality by manipulating temporary files. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Weakness: CWE-379

Which versions are affected by CVE-2025-64896?

It affects 1 product.

Products include Adobe Creative Cloud.

How do I fix CVE-2025-64896?

No fix has been published for CVE-2025-64896 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-64896 being exploited?

There is no known exploitation of CVE-2025-64896 in the wild and no public exploit code.

Sources

Also known as GHSA-92hr-cjp6-738x.