A heap-based buffer overflow exists in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier. The flaw can be triggered by loading a specially crafted file, allowing an attacker to overwrite memory and execute arbitrary code in the context of the current user. The weakness is a heap-based buffer overflow (CWE-122) and could lead to full compromise of the targeted workstation, including data theft, ransomware, or persistence mechanisms.

Adobe InDesign Desktop is affected when installed with versions 21.3, 20.5.3 or older. Any deployment of these versions that processes external files is potentially vulnerable. Systems running newer releases are not known to be impacted.

The CVSS score of 7.8 indicates a high risk. Because exploitation requires the user to open a malicious file, the attack vector is user interaction. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation remains uncertain, yet the potential impact warrants immediate attention.