What is the CVSS score of CVE-2026-27284?

CVE-2026-27284 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Indesign Desktop are affected by CVE-2026-27284?

Adobe InDesign Desktop versions 20.5.2 and 21.2 and earlier contain a critical out-of-bounds read vulnerability (CVE-2026-27284) that allows arbitrary code execution when users open malicious files,…

How to fix or mitigate CVE-2026-27284?

Within 24 hours: inventory all InDesign Desktop installations and document affected versions (20.5.2, 21.2, and earlier); disable InDesign's automatic file opening features and restrict file access from untrusted sources. Within 7 days: implement application whitelisting for InDesign executables; block suspicious .indd and related document types at email gateways; brief users on opening files only from verified sources. Within 30 days: monitor Adobe security advisories for patch release; test and deploy patched InDesign version immediately upon availability; consider temporary migration of non-essential design tasks to alternative applications if patch delay extends beyond 60 days.

Indesign Desktop CVE-2026-27284

EUVD-2026-22438 HIGH

Out-of-bounds Read (CWE-125)

2026-04-14 adobe

GHSA-fvjj-hmp9-fr4c

Buffer Overflow Information Disclosure Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 15:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 18:50 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22438

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:45 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Out-of-bounds read in Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier enables arbitrary code execution when users open malicious files. Attack requires local access and user interaction (CVSS AV:L/UI:R) but no authentication (PR:N), allowing attackers with file delivery capability to execute code as the victim user. No public exploit identified at time of analysis, though the vulnerability class (CWE-125 out-of-bounds read) is well-understood and commonly weaponized in document processors.

Technical ContextAI

This vulnerability affects Adobe InDesign Desktop's file parsing subsystem, classified as CWE-125 (Out-of-bounds Read). When processing malformed InDesign documents, the application reads memory beyond allocated buffer boundaries. While out-of-bounds reads primarily cause information disclosure by exposing adjacent memory contents, Adobe assesses this specific instance as exploitable for arbitrary code execution in the user context, suggesting the read primitive can be chained with other memory corruption conditions or used to bypass address space layout randomization (ASLR). The affected component is the document parser handling InDesign's proprietary file format (.indd/.indl/.indt). CPE identifier cpe:2.3:a:adobe:indesign_desktop indicates all versions through 21.2 contain the vulnerable parsing code across Windows and macOS platforms.

RemediationAI

Apply vendor-released patches by upgrading Adobe InDesign Desktop to the versions specified in security bulletin APSB26-32, available at https://helpx.adobe.com/security/products/indesign/apsb26-32.html. Adobe typically releases patches for the two most recent major versions; users should upgrade to the latest patched release in their version branch (exact fixed versions are detailed in the advisory). Organizations unable to patch immediately should implement defense-in-depth controls: restrict InDesign file sources to trusted partners only, enforce email attachment scanning with sandboxing for .indd/.indl/.indt files, disable automatic preview generation, and educate users to verify file provenance before opening. Application whitelisting and endpoint detection/response (EDR) tools can detect post-exploitation activity if an attack succeeds.