Description
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-01-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a heap‑based buffer overflow in Adobe InDesign Desktop that allows an attacker to execute arbitrary code with the privileges of the user who opens a specially crafted file. The flaw arises when the application processes data from the malicious source file, corrupting memory and enabling code execution.

Affected Systems

Adobe InDesign Desktop versions 21.0, 19.5.5 and earlier on both macOS and Windows are affected.

Risk and Exploitability

The flaw carries a CVSS score of 7.8, indicating a high severity. However the EPSS score is below 1 %, suggesting that widespread exploitation is unlikely and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the user to open a malicious file, therefore the threat surface is limited to environments where untrusted InDesign documents can be accessed.

Generated by OpenCVE AI on April 18, 2026 at 06:35 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe InDesign Desktop to the most recent release (e.g., version 22.0 or later) which includes the vulnerability fix.
  • Restrict users from opening InDesign files from untrusted or unknown sources; educate users about the risk of opening unsolicited files.
  • Configure macOS Gatekeeper and Windows Defender or similar endpoint protection to scan and quarantine suspicious InDesign files before they are processed.

Generated by OpenCVE AI on April 18, 2026 at 06:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Jan 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Microsoft
Microsoft windows
Weaknesses CWE-787
CPEs cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Microsoft
Microsoft windows

Wed, 14 Jan 2026 11:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe indesign
Vendors & Products Adobe
Adobe indesign

Tue, 13 Jan 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Jan 2026 19:00:00 +0000

Type Values Removed Values Added
Description InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Indesign
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-02-26T15:04:15.592Z

Reserved: 2025-12-12T22:01:18.192Z

Link: CVE-2026-21304

cve-icon Vulnrichment

Updated: 2026-01-13T19:04:14.817Z

cve-icon NVD

Status : Analyzed

Published: 2026-01-13T19:16:26.337

Modified: 2026-01-14T19:29:14.490

Link: CVE-2026-21304

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T06:45:23Z

Weaknesses