What is the CVSS score of CVE-2026-34627?

CVE-2026-34627 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Indesign Desktop are affected by CVE-2026-34627?

Adobe InDesign Desktop versions 20.5.2 and 21.2 contain a heap-based buffer overflow that allows arbitrary code execution when users open malicious files, potentially compromising systems with full…

How to fix or mitigate CVE-2026-34627?

Within 24 hours: Identify and inventory all Adobe InDesign Desktop installations (versions 20.5.2, 21.2, and earlier) across the organization using endpoint detection tools; disable InDesign's auto-open features and implement mandatory security awareness training prohibiting file opening from untrusted sources. Within 7 days: Restrict InDesign usage to isolated, non-administrative user accounts; establish a file review process requiring IT approval before opening design files from external parties; configure application whitelisting to prevent unsigned code execution. Within 30 days: Monitor Adobe security advisories daily for patch availability (expected versions 20.5.3, 21.3, or equivalent); schedule immediate patch deployment within 48 hours of release; conduct phishing simulations targeting users with malicious InDesign file attachments.

Indesign Desktop CVE-2026-34627

EUVD-2026-22650 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 adobe

GHSA-38g6-9fgr-3mmj

RCE Buffer Overflow Heap Overflow Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 21:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:38 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22650

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

CVE Published

Apr 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high confidentiality, integrity, and availability impact when users open malicious files. No public exploit identified at time of analysis. Attack requires local access and user interaction (opening a crafted file), with low attack complexity and no authentication requirements (CVSS:3.1 AV:L/AC:L/PR:N/UI:R). EPSS risk data not available; vulnerability enables complete system compromise in user context.

Technical ContextAI

This vulnerability (CWE-122: Heap-based Buffer Overflow) affects Adobe InDesign Desktop's file parsing mechanisms. Heap-based buffer overflows occur when a program writes data beyond the allocated memory boundaries in the heap, a dynamic memory allocation area. In InDesign's context, this likely involves improper bounds checking when processing specific file format elements (potentially INDD, IDML, or imported graphics formats). The affected CPE (cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:*) encompasses all InDesign Desktop installations through version 21.2. Unlike stack-based overflows, heap corruption can be more complex to exploit but offers attackers flexible control over memory layout, enabling reliable arbitrary code execution when successfully weaponized. The vulnerability allows attackers to manipulate heap metadata or function pointers to redirect program execution flow.

RemediationAI

Organizations should immediately update Adobe InDesign Desktop to the latest patched version as specified in Adobe Security Bulletin APSB26-32. Visit https://helpx.adobe.com/security/products/indesign/apsb26-32.html for patch distribution details and exact fixed version numbers. Until patching is complete, implement defense-in-depth controls including restricting InDesign users from opening files from untrusted sources, deploying endpoint detection and response (EDR) solutions to monitor InDesign process behavior for exploitation indicators, and enforcing application sandboxing where available. User awareness training should emphasize risks of opening unsolicited INDD files or design templates from unknown sources. For high-security environments, consider temporarily restricting InDesign file imports to known-safe internal sources until patching is verified complete across the organization.