A heap‑based buffer overflow exists in Adobe InDesign Desktop that can allow an attacker to execute arbitrary code in the context of the current user. The flaw arises from improper bounds checking when processing a malicious file, and exploitation requires the victim to open that file. Successful exploitation would let an attacker run code with the user’s privileges, compromising confidentiality, integrity, and availability.

Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier are affected. Users running any of these versions on supported platforms are vulnerable until they apply the Adobe security update.

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a moderate exploitation probability. Because the attack requires user interaction—opening a crafted file—attacks are most likely delivered via email attachments or downloads. The local impact means that a successful exploit escalates to the user’s privileges, making the vulnerability critical for systems that handle untrusted documents.