EUVD-2026-22432Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Heap-based buffer overflow in Adobe InDesign Desktop 20.5.2, 21.2 and earlier enables arbitrary code execution with high confidentiality, integrity, and availability impact. Attack requires local access and user interaction (victim opens malicious InDesign file), with low attack complexity and no authentication barriers. CVSS 7.8 reflects significant impact once social engineering succeeds. No CISA KEV listing indicates no confirmed active exploitation at time of analysis. Adobe has published security advisory APSB26-32 addressing this vulnerability.
Technical ContextAI
This vulnerability affects Adobe InDesign Desktop, a professional desktop publishing application used for print and digital media layout design. The flaw is a heap-based buffer overflow (CWE-122), occurring when the application processes specially crafted InDesign files. Heap overflows arise when a program writes data beyond the allocated heap memory boundary, corrupting adjacent memory structures. In InDesign's case, malformed file parsing triggers excessive data writes to heap buffers, allowing attackers to overwrite critical memory regions. The affected CPE cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* indicates all editions of the desktop application through version 21.2 are vulnerable. Unlike stack-based overflows, heap exploitation often requires more sophisticated techniques but enables reliable code execution when combined with heap spraying or memory manipulation methods common in document-based attacks.
RemediationAI
Organizations should upgrade Adobe InDesign Desktop to the patched versions specified in Adobe Security Bulletin APSB26-32 (https://helpx.adobe.com/security/products/indesign/apsb26-32.html). While exact remediated version numbers are not provided in available intelligence, Adobe's advisory contains definitive upgrade paths for affected 20.x and 21.x branches. Administrators should deploy patches through Adobe Creative Cloud management tools or direct downloads per the bulletin's instructions. As interim risk reduction until patching completes, implement user awareness training emphasizing risks of opening InDesign files from untrusted sources, establish email gateway filtering for suspicious .indd/.indt attachments, and consider application sandboxing or restricted execution policies for InDesign processes. Organizations in high-risk sectors (publishing, advertising, media production) should prioritize emergency patching due to frequent handling of external design files. Verify patch deployment through Adobe Creative Cloud version reporting or endpoint management tools, targeting completion within standard patch cycles for local exploitation vulnerabilities (30-60 days for most enterprises, 7-14 days for high-risk creative industries).
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today