What is the CVSS score of CVE-2026-21357?

CVE-2026-21357 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-21357?

Within 24 hours: Inventory all InDesign installations and identify affected versions (21.1, 20.5.1, and earlier). Issue a user advisory prohibiting opening InDesign files from untrusted sources. Within 7 days: Implement application whitelisting or disable InDesign for non-essential users; restrict file access through network controls where feasible. Within 30 days: Monitor Adobe security advisories for patch availability and establish an expedited testing and deployment process upon release.

Indesign CVE-2026-21357

Q: Which versions of Indesign are affected by CVE-2026-21357?

Adobe InDesign versions 21.1, 20.5.1 and earlier contain a critical heap-based buffer overflow vulnerability that could allow attackers to execute arbitrary code on affected systems.

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-10 psirt@adobe.com

Buffer Overflow Heap Overflow Adobe Indesign

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.8

DescriptionNVD

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign versions 21.1, 20.5.1, and earlier through a heap buffer overflow vulnerability triggered by opening a malicious file. The vulnerability requires user interaction and executes with the privileges of the current user, with no patch currently available. …

RemediationAI

Within 24 hours: Inventory all InDesign installations and identify affected versions (21.1, 20.5.1, and earlier). Issue a user advisory prohibiting opening InDesign files from untrusted sources. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-21357 vulnerability details – vuln.today

Back

Indesign CVE-2026-21357

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code