How to fix CVE-2026-27291?

Within 24 hours: Inventory all InDesign installations and identify users running versions through 21.2. Within 7 days: Implement user awareness training emphasizing risks of opening InDesign documents from untrusted sources and establish document review procedures. Within 30 days: Monitor Adobe's APSB26-32 security bulletin for patch release and deploy immediately upon availability; if InDesign is non-critical, consider temporary version downgrade or disabling InDesign launch of untrusted file types via Group Policy or endpoint controls.

Is Memory Corruption affected by CVE-2026-27291?

Adobe InDesign Desktop versions up to 21.2 contain an arbitrary code execution vulnerability that allows attackers to execute malicious code with full user privileges through specially crafted documents.

CVE-2026-27291

EUVD-2026-22443 HIGH

2026-04-14 adobe

GHSA-gvx9-4v4m-4c43

Buffer Overflow RCE Memory Corruption

7.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 18:49 vuln.today

DescriptionNVD

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions through 21.2 allows unauthenticated attackers to execute malicious code with full user privileges by exploiting an out-of-bounds write vulnerability via a specially crafted InDesign file. Attack requires local access and user interaction to open the malicious document. …

RemediationAI

Within 24 hours: Inventory all InDesign installations and identify users running versions through 21.2. Within 7 days: Implement user awareness training emphasizing risks of opening InDesign documents from untrusted sources and establish document review procedures. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-27291 vulnerability details – vuln.today

Back

CVE-2026-27291

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code