An attacker can exploit a heap-based buffer overflow in Adobe InCopy versions 21.0, 19.5.5 and earlier by delivering a specially crafted file. When a victim opens this file, the vulnerable code can overwrite memory and execute arbitrary code with the privileges of the current user. The weakness arises from improper bounds checking while parsing document data, classifying it under CWE‑122 and CWE‑787. Successful exploitation can compromise the confidentiality, integrity, and availability of the affected system.

Affected installations include any Adobe InCopy deployment running the affected releases, regardless of operating system. The vulnerable versions are 21.0, 19.5.5 and all previous releases. As the products operate on Windows and macOS platforms, any user running those environments is at risk if an older version is in use.

The CVSS v3 score of 7.8 indicates a high severity. The EPSS score of less than 1% indicates that the likelihood of exploitation in the wild is currently very low, and Adobe is not listed in the CISA KEV catalog. Nevertheless, the vulnerability requires user interaction—a malicious file must be opened—so the threat surface is limited to environments where users have the ability to access or download files from untrusted sources.