Adobe InCopy versions 21.3, 20.5.3 and all earlier releases contain a stack‑based buffer overflow that an attacker can trigger by providing a specially crafted file. The overflow can overwrite return addresses on the call stack, enabling the execution of arbitrary code in the context of the current user. The vulnerability does not require special privilege or network connectivity, so its impact is limited to the account that opens the malicious file, but it still allows an attacker to compromise local integrity and confidentiality by running arbitrary programs.

Adobe InCopy products, specifically version 21.3, version 20.5.3 and any earlier release. No other Adobe applications are affected according to the current advisory.

The CVSS score of 7.8 indicates a high severity. The attack vector is user interaction: a victim must open a malicious file, which limits exploitability to social engineering or drive‑by attacks. The EPSS score is not available, but the lack of a KEV listing suggests no widespread exploitation has been observed yet. Nevertheless, because the flaw enables arbitrary code execution, the potential damage—including data theft, modification, or local denial of service—is significant if the victim is a privileged user.