Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier suffer an out‑of‑bounds write that allows a malicious document to corrupt memory and execute code with the privileges of the user who opens the file. The flaw originates from improper bounds checking during parsing of certain file formats. Successful exploitation can lead to arbitrary code execution, providing the attacker full control over the affected system in the context of the compromised user.

Affected are Adobe InDesign Desktop releases 20.5.2, version 21.2 and any earlier builds. These versions are included in the 2026 Adobe product suite and are deployed in creative studios and graphic design environments.

The CVSS base score of 7.8 indicates a high severity. EPSS data is not reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction: the victim must open a specially crafted InDesign file. As the flaw is triggered during file parsing, the likely attack vector is a malicious document or a file embedded in a phishing email. Given the user‑interaction prerequisite, the risk is medium to high for individuals who frequently open unknown design files.