Indesign Desktop CVE-2026-34628

The victim must open a malicious file in Adobe InDesign Desktop versions 20.5.2, 21.2, or earlier. The attacker can be any unauthenticated user. No special configuration required; default installations are vulnerable.

Real-world risk assessment reveals moderate-to-high concern despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with low complexity but mandatory user interaction, limiting attack surface to social engineering scenarios where victims must open malicious InDesign files. CISA SSVC framework corroborates this assessment: exploitation status is 'none' (no active exploitation), not automatable (requires human interaction), but delivers 'total' technical impact (full compromise of affected system). The combination of local-only access requirement and user interaction dependency significantly reduces mass exploitation probability compared to remotely exploitable vulnerabilities. However, the lack of authentication requirements (PR:N) means any local user or attacker with file delivery capability can trigger the vulnerability. Targeted attacks against creative professionals, publishing houses, or organizations using InDesign workflows represent the primary threat vector. The absence of public exploit code and KEV listing suggests this remains a pre-exploitation window, making immediate patching feasible before weaponization occurs.

An attacker crafts a malicious InDesign document (.indd file) containing specially formatted data that triggers the heap-based buffer overflow during file parsing. The attacker delivers this weaponized file via email, file sharing, or compromised download sites, using social engineering to convince a designer or publisher to open it. When the victim launches the file in InDesign Desktop 21.2 or earlier, the overflow overwrites heap memory structures, redirecting execution flow to attacker-controlled shellcode that executes with the victim's user privileges, potentially installing malware, exfiltrating intellectual property, or establishing persistent access to the creative workstation.