Indesign Desktop CVE-2026-34627

The victim must open a crafted malicious file in Adobe InDesign Desktop versions 20.5.2, 21.2, or earlier. Local access required; no authentication needed. Arbitrary code execution occurs in the context of the current user.

Real-world risk assessment reveals moderate-to-high priority despite the 7.8 CVSS score. The CVSS vector indicates local attack vector (AV:L) requiring user interaction (UI:R), which significantly limits attack surface compared to network-based vulnerabilities. However, the low attack complexity (AC:L) and no privilege requirements (PR:N) make exploitation straightforward once social engineering succeeds. No public exploit identified at time of analysis and no CISA KEV listing indicates this is not confirmed actively exploited. The complete impact triad (C:H/I:H/A:H) with unchanged scope (S:U) means successful exploitation grants full control within user context. For organizations using InDesign in creative workflows, the social engineering vector (malicious files disguised as legitimate design assets, client submissions, or template downloads) presents realistic risk. SSVC decision framework suggests elevated priority for organizations where InDesign users frequently process external files, balanced against the local-only attack vector limiting automated exploitation potential. This vulnerability requires targeted delivery but offers high reward for attackers focused on creative industry espionage or intellectual property theft.

An attacker crafts a malicious InDesign document (INDD file) containing specially formatted data that triggers the heap-based buffer overflow when parsed by vulnerable InDesign versions. The attacker distributes this weaponized file through targeted spear-phishing emails to creative professionals, disguised as a client project template, design asset package, or portfolio sample. When the victim opens the malicious file in InDesign Desktop 21.2 or earlier, the overflow corrupts heap memory structures, allowing the attacker to execute arbitrary code with the victim's user privileges, potentially installing backdoors, exfiltrating intellectual property, or pivoting to other network resources accessible to the compromised user account.