A stack-based buffer overflow exists in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier. Triggering the overflow allows an attacker to execute arbitrary code on the affected system with the privileges of the user who opens a malicious file. The flaw originates from insufficient bounds checking when processing InDesign document files.

Adobe InDesign Desktop users running any version up to and including 21.3 or 20.5.3 are vulnerable. The attack vector requires the victim to open a specially crafted InDesign file; no network exploitation or remote code execution is possible without user interaction.

The CVSS score of 7.8 indicates high severity, and the vulnerability is not listed in CISA’s KEV catalog. Although EPSS data is not available, the necessity of file opening suggests moderate likelihood of real‑world exploitation because it relies on social engineering or user curiosity. Successful exploitation would allow local code execution, potentially compromising the entire system if the user has administrative rights.