What is the CVSS score of CVE-2026-27283?

CVE-2026-27283 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Indesign Desktop are affected by CVE-2026-27283?

Adobe InDesign Desktop versions 20.5.2 and 21.2 and earlier contain a use-after-free vulnerability enabling arbitrary code execution when users open maliciously crafted files, potentially…

How to fix or mitigate CVE-2026-27283?

Within 24 hours: Inventory all InDesign Desktop installations and identify affected versions (20.5.2, 21.2, and earlier). Within 7 days: Implement file-source restrictions and user awareness training prohibiting opening InDesign files from untrusted sources; consider disabling InDesign file handling in email clients where feasible. Within 30 days: Monitor Adobe security advisories for patch availability and plan immediate deployment upon release; evaluate migration to later versions if available through your Adobe licensing agreement.

Indesign Desktop CVE-2026-27283

EUVD-2026-22436 HIGH

Use After Free (CWE-416)

2026-04-14 adobe

GHSA-565x-2q82-2jr2

RCE Denial Of Service Use After Free Memory Corruption Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 18:49 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22436

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:45 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to execute malicious code with current user privileges through maliciously crafted files. The use-after-free vulnerability requires user interaction (opening a weaponized InDesign file) but offers high impact across confidentiality, integrity, and availability. EPSS data not provided; no public exploit identified at time of analysis. Exploitation likelihood increased by low attack complexity (CVSS AC:L) requiring only basic social engineering to deliver malicious files.

Technical ContextAI

This vulnerability stems from a use-after-free memory corruption flaw (CWE-416) in Adobe InDesign Desktop's file parsing logic. Use-after-free conditions occur when application code continues to reference memory locations after they have been deallocated, creating exploitable conditions where attackers can control freed memory regions and redirect program execution flow. InDesign Desktop, Adobe's professional desktop publishing software, processes complex document formats containing embedded graphics, fonts, and layout data. The CPE identifier cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* indicates all InDesign Desktop editions through version 21.2 are affected. The local attack vector (AV:L) indicates exploitation requires the malicious file to be processed locally on the victim's system, typically through email attachments, file shares, or malicious downloads disguised as legitimate InDesign project files.

RemediationAI

Apply vendor-released patches detailed in Adobe Security Bulletin APSB26-32 available at https://helpx.adobe.com/security/products/indesign/apsb26-32.html. Organizations should upgrade all InDesign Desktop installations to the patched versions specified in the advisory, which addresses the use-after-free vulnerability in file parsing routines. Until patches can be deployed, implement defense-in-depth controls including restricting InDesign file sources to trusted partners only, scanning incoming files with updated antivirus signatures, opening untrusted InDesign files in sandboxed or isolated environments, and educating creative teams on risks of opening unsolicited project files. Apply principle of least privilege to limit user account permissions where InDesign is installed, reducing potential impact of successful exploitation.