Description
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-01-13
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Memory Exposure
Action: Apply Patch
AI Analysis

Impact

An out‑of‑bounds read in InDesign Desktop can cause memory exposure, allowing an attacker to read sensitive data from memory. The flaw requires a victim to open a malicious file, therefore user interaction is necessary for exploitation.

Affected Systems

Adobe InDesign Desktop, versions 21.0, 19.5.5 and all earlier releases are affected.

Risk and Exploitability

The vulnerability has a CVSS score of 5.5, indicating moderate severity, and an EPSS score of less than 1%, reflecting a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Exploitation requires that a user opens a specially crafted InDesign file, so the attack vector is primarily local input exploitation via a crafted file.

Generated by OpenCVE AI on April 18, 2026 at 16:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe InDesign to a newer, non‑affected version (e.g., 21.1 or later) and apply Adobe’s latest security patch.
  • Avoid opening or executing unknown InDesign files; verify the file source before opening.
  • Configure system or application settings to disable automatic opening of files received via email or untrusted locations to prevent the file from being opened without user interaction.

Generated by OpenCVE AI on April 18, 2026 at 16:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Jan 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Jan 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe indesign
Vendors & Products Adobe
Adobe indesign

Tue, 13 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Jan 2026 19:00:00 +0000

Type Values Removed Values Added
Description InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title InDesign Desktop | Out-of-bounds Read (CWE-125)
Weaknesses CWE-125
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N'}

Subscriptions

Adobe Indesign
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-01-13T19:06:06.133Z

Reserved: 2025-12-12T22:01:18.188Z

Link: CVE-2026-21278

cve-icon Vulnrichment

Updated: 2026-01-13T19:06:00.939Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-13T19:16:25.530

Modified: 2026-01-14T19:28:15.707

Link: CVE-2026-21278

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T16:30:05Z

Weaknesses