What is the CVSS score of CVE-2026-27285?

CVE-2026-27285 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Indesign Desktop CVE-2026-27285

EUVD-2026-22440 MEDIUM

Heap-based Buffer Overflow (CWE-122)

2026-04-14 adobe

Buffer Overflow Heap Overflow Adobe Indesign Desktop

5.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 18:49 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:00 euvd

EUVD-2026-22440

Analysis Generated

Apr 14, 2026 - 17:00 vuln.today

CVE Published

Apr 14, 2026 - 16:45 nvd

MEDIUM 5.5

DescriptionCVE.org

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows local attackers to cause application denial-of-service by crafting malicious files that trigger memory corruption when opened. This vulnerability requires user interaction to exploit and does not enable code execution or data compromise, making it primarily a disruption vector rather than a critical attack surface despite its moderate CVSS score of 5.5.

Technical ContextAI

The vulnerability exists in InDesign Desktop's file parsing logic, specifically a heap-based buffer overflow (CWE-122) that occurs when the application processes specially crafted input files. A heap buffer overflow occurs when data is written beyond the allocated bounds of a heap-allocated buffer, corrupting adjacent heap structures. This can lead to application crashes when corrupted metadata is accessed or when heap management routines detect corruption. The affected versions are InDesign Desktop up through version 21.2, indicating the issue persists across multiple major and minor releases. The local attack vector combined with the requirement for user interaction (opening a malicious file) limits the attack surface to scenarios where an attacker can deliver a crafted document to a target user.

RemediationAI

Update Adobe InDesign Desktop to version 21.3 or later, which addresses this heap buffer overflow vulnerability. Users unable to immediately update should avoid opening files from untrusted sources, particularly files in InDesign's native formats (.indd) or imported document types that may trigger the vulnerable parsing code. Organizations should apply the patch via Adobe's standard update mechanism or obtain it directly from the security advisory at https://helpx.adobe.com/security/products/indesign/apsb26-32.html. Adobe typically delivers patches through Creative Cloud subscription automatic updates, but manual verification of version number post-update is recommended given the scope of affected versions.