A stack-based buffer overflow exists in older releases of Adobe InDesign Desktop. The flaw can be triggered by opening a maliciously crafted file, allowing an attacker to execute arbitrary code in the context of the current user. This weakness is classified under CWE‑121 and could compromise the confidentiality, integrity, and availability of the affected system if exploited.

Adobe InDesign Desktop versions 21.3, 20.5.3 and all earlier releases are vulnerable. Updates released after these versions contain the fix.

The CVSS score of 7.8 labels the vulnerability as high risk, and while the EPSS score is not publicly available, the lack of a KEV listing suggests it has not yet been widely targeted. Because exploitation requires the victim to open a malicious file, the threat vector is local user interaction. Once triggered, the attacker gains full user‑level privileges on the host machine.