InDesign Desktop is vulnerable to an access of uninitialized pointer flaw that can be exploited to execute arbitrary code with the privileges of the currently logged‑in user. The vulnerability requires the user to open a specially crafted file, after which the program can run arbitrary instructions in the user’s context.

Adobe InDesign Desktop versions 21.0, 19.5.5 and all earlier releases are affected. The issue applies to installations on macOS, Windows, and other operating systems where the desktop application runs.

The flaw carries a CVSS score of 7.8, indicating high severity. The EPSS score is less than 1 %, suggesting that exploitation is unlikely but still possible. Because the CVE is not listed in the CISA KEV catalog, no active exploit traffic has been reported. An attacker would need to convince a user to open a malicious file, making it a user‑interaction vulnerability. If executed, the attacker gains the privileges of the user who performed the file open, potentially allowing tampering with files, execution of further malware, or escalation within the system.