A heap‑based buffer overflow in Adobe InDesign Desktop allows an attacker to execute arbitrary code within the context of the user opening a malicious document. The vulnerability can lead to compromise of confidentiality, integrity, and availability of the affected system, as the attacker gains the same privileges as the victim user. This weakness is identified as CWE‑122.

Adobe InDesign Desktop versions 21.3, 20.5.3, and earlier are affected.

The CVSS score of 7.8 indicates a high severity, and the EPSS score is not available, meaning the current exploitation likelihood cannot be quantified; the vulnerability is not listed in CISA’s KEV catalog. Attackers need the victim to open a crafted file, indicating that the primary attack vector is user‑initiated file execution. If the malicious document is opened, arbitrary code execution can occur with the victim’s privileges.