This vulnerability arises from a null pointer dereference that can crash the InDesign Desktop application. An attacker can cause the software to terminate, resulting in a denial-of-service for the affected user. The flaw resides in memory handling of file input, as indicated by the CWE-476 classification. The documented impact is the loss of service for the application; no arbitrary code execution or data exfiltration is reported.

Adobe InDesign Desktop versions 21.3, 20.5.3 and all earlier releases are impacted. Any installation of these builds that processes user-specified files may be vulnerable.

The CVSS score of 5.5 positions this vulnerability as moderate. Its EPSS is not available and it is not listed in the CISA KEV catalog, indicating a lower frequency of observed exploitation. However, the attack requires the victim to open a malicious file, so the likelihood of exploitation depends on user behavior. The typical exploitation path involves the user opening a crafted file, triggering the null dereference and causing the application to crash; no privilege escalation or data compromise is required.