InDesign Desktop versions 20.5.2, 21.2, and earlier contain a heap‑based buffer overflow that allows an attacker to execute code with the victim’s user privileges. The flaw arises when the software processes a specially crafted document, giving the attacker the ability to run arbitrary code. This weakness is classified as CWE‑122, and the vulnerability requires the victim to open a malicious file.

Adobe InDesign Desktop is affected. Users running versions 20.5.2, 21.2, or any prior release are vulnerable. No other Adobe products are listed as impacted in this advisory.

The CVSS base score of 7.8 indicates a high severity. Since the exploit requires the victim to open a malicious file, the attack vector is local user interaction. The absence of an EPSS score leaves the exact likelihood uncertain, but the high CVSS implies that if a suitable file is delivered, an attacker can achieve code execution. The vulnerability is not listed in the CISA KEV catalog, and no automated exploits have been reported publicly.