Description
InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-02-10
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

InDesign Desktop versions 21.1, 20.5.1 and earlier suffer from a heap‑based buffer overflow that allows arbitrary code execution when a user opens a malicious file. The flaw is identified as CWE-122 and CWE-787. Exploitation causes code to run with the victim’s user privileges, potentially compromising the entire machine.

Affected Systems

Adobe InDesign Desktop on both macOS and Windows platforms is affected. The vulnerability exists in releases 21.1, 20.5.1 and earlier. All installations running the affected versions on these operating systems must be updated to a patched release.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8, indicating high severity. The EPSS score is below 1%, signifying a low probability of exploitation at present, and it is not listed in the CISA KEV catalog. The required user interaction – opening a crafted file – limits automated exploitation but still poses a significant risk in environments where users frequently handle untrusted documents. Effective mitigation requires immediate patching.

Generated by OpenCVE AI on April 18, 2026 at 12:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Adobe InDesign Desktop to the latest version that fixes the heap buffer overflow, following Adobe's security advisory.
  • Disable automatic opening of unknown or suspicious file types and educate users about the risks of opening files from untrusted sources.
  • If the update cannot be applied immediately, use file quarantine or sandboxing features to mitigate risk.

Generated by OpenCVE AI on April 18, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 11 Feb 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe indesign Desktop
Vendors & Products Adobe indesign Desktop

Wed, 11 Feb 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe indesign
Apple
Apple macos
Microsoft
Microsoft windows
Weaknesses CWE-787
CPEs cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Adobe
Adobe indesign
Apple
Apple macos
Microsoft
Microsoft windows

Tue, 10 Feb 2026 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 18:15:00 +0000

Type Values Removed Values Added
Description InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title InDesign Desktop | Heap-based Buffer Overflow (CWE-122)
Weaknesses CWE-122
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Indesign Indesign Desktop
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-02-26T14:44:32.963Z

Reserved: 2025-12-12T22:01:18.206Z

Link: CVE-2026-21357

cve-icon Vulnrichment

Updated: 2026-02-10T19:01:36.002Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-10T18:16:32.707

Modified: 2026-02-11T18:29:22.320

Link: CVE-2026-21357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:00:08Z

Weaknesses