A heap-based buffer overflow can cause Adobe InDesign Desktop to crash, leading to a denial-of-service condition for the user. The flaw is accessed through a malicious file and requires user interaction to trigger it. As the crash terminates the application, an attacker can disrupt the user’s workflow but cannot gain elevated privileges or execute arbitrary code.

Adobe InDesign Desktop versions 21.1, 20.5.1 and all earlier releases on macOS and Windows are affected. Users of these operating systems running the vulnerable InDesign variants are at risk if they open untrusted files.

The CVSS score of 5.5 classifies the vulnerability as moderate, and the EPSS score of less than 1% indicates a very low probability of exploitation. The issue is not listed in CISA’s KEV catalog, suggesting limited public exploitation. The attack vector is user interaction; an attacker must craft a malicious InDesign file and convince or trick a victim into opening it, after which the application will crash and cause service disruption.