An out‑of‑bounds read in Adobe InDesign Desktop allows a memory disclosure when a malicious file is opened. The flaw can expose confidential data stored in memory. The vulnerability is classified as CWE‑125 and is triggered only when the victim opens a crafted document, so the attacker cannot influence the read without user interaction.

Adobe InDesign Desktop, versions 21.3, 20.5.3 and all older releases are affected. The issue originates from the file‑parsing component that does not correctly bound‑check a memory buffer when processing certain document types.

The CVSS score of 5.5 indicates a moderate risk. No EPSS score is available and the flaw is not listed in the CISA KEV catalog, suggesting limited exploitation data to date. However, because the attack requires opening a file, it is most likely to be used in malware or phishing campaigns where a user is tricked into opening a malicious document. The need for user interaction lowers the likelihood of widespread exploitation, but it remains a valid threat for environments that process untrusted files.