Adobe InCopy versions 21.3, 20.5.3 and earlier contain an out‑of‑bounds write flaw that can lead to arbitrary code execution in the context of the current user. The vulnerability is triggered when a maliciously crafted file is opened within the application, allowing an attacker to overwrite adjacent memory and execute injected code. The primary impact is the execution of arbitrary code with the permissions of the user who opens the file, potentially compromising the machine or the network.

The affected product is Adobe InCopy. Versions 21.3, 20.5.3 and all earlier releases of the software are vulnerable. The issue does not affect other Adobe products or later builds beyond the stated version thresholds.

The CVSS score of 7.8 reflects a high severity. The vulnerability is not listed in CISA’s KEV catalog. Because the exploitation requires the victim to open a malicious file, the attack vector is user interaction, making it more likely to be successful in environments where users routinely process untrusted documents. The combination of high CVSS, the requirement for user action, and the potential for arbitrary code execution indicates a moderate to high risk for affected installations.