EUVD-2026-22442
GHSA-r9v7-9p75-jjw3
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
4DescriptionCVE.org
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Heap-based buffer overflow in Adobe InDesign Desktop versions 21.2 and earlier allows local attackers to disclose sensitive information from memory without authentication, requiring only user interaction to open a malicious file. The vulnerability has a CVSS score of 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit code or active exploitation has been confirmed at time of analysis.
Technical ContextAI
This vulnerability exploits a heap-based buffer overflow condition (CWE-122) in Adobe InDesign Desktop's file parsing logic. Heap overflows occur when data is written beyond the allocated boundaries of heap memory, potentially corrupting adjacent data structures and enabling information disclosure. InDesign's document processing engine, which handles proprietary Adobe formats and embedded resources, is the likely attack surface. The local attack vector and requirement for user interaction (opening a file) indicate the vulnerability resides in document deserialization or format parsing routines that process untrusted file content without proper bounds checking. The confidentiality-only impact suggests the overflow enables reading adjacent heap memory rather than execution or denial of service.
RemediationAI
Users must upgrade InDesign Desktop to a patched version released after 21.2. Adobe's security advisory APSB26-32 (https://helpx.adobe.com/security/products/indesign/apsb26-32.html) provides the specific remediated version number and upgrade instructions. No workaround is available for this memory-disclosure vulnerability. In the interim, organizations should restrict file-opening permissions, disable automatic document opening features, and educate users to avoid opening InDesign files from untrusted sources. Patch availability and exact fix versions should be confirmed directly from Adobe's official advisory before deployment.
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Same weakness CWE-122 – Heap-based Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today