Adobe InCopy versions 20.5.2, 21.2 and earlier are vulnerable to an out‑of‑bounds read when parsing a specially crafted file, allowing an attacker to read data past the end of an allocated memory structure. This flaw can be leveraged to execute code in the context of the current user. The vulnerability is identified as CWE‑125, and it requires a victim to open the malicious file, implying that user interaction is necessary for exploitation.

The affected software is Adobe InCopy. All installations of InCopy version 20.5.2, 21.2 and any earlier releases are impacted. No information is provided about specific build or patch levels beyond the version numbers mentioned.

The flaw carries a CVSS v3 score of 7.8, classifying it as high severity. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation relies on a user‑initiated action of opening a malicious file, so the attack vector is local file use rather than a network‑based attack. Due to the lack of network exposure, the immediate risk is confined to users who access potentially untrusted documents within InCopy.