Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier contain an out‑of‑bounds write that can lead to arbitrary code execution within the context of the current user. The vulnerability is triggered when a malicious document is opened, allowing an attacker to control the execution flow of InDesign. Successful exploitation would compromise confidentiality, integrity, and availability of the affected system and could spread malware further if the user shares or propagates the infected file.

Adobe InDesign Desktop is affected, specifically deployments of versions 21.3, 20.5.3 and all earlier releases. The vulnerability does not extend to other Adobe products or later InDesign versions that have received the official fix.

The CVSS score of 7.8 denotes a high severity, while the EPSS score is not available, so the exact exploitation likelihood is unknown. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation is reported yet. Attackers must rely on user interaction to open a malicious InDesign file, so the attack vector is user‑initiated local file execution. Nonetheless, the potential for arbitrary code execution poses a significant risk to systems that open or download InDesign documents without adequate control.