What is the CVSS score of CVE-2026-34628?

CVE-2026-34628 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Indesign Desktop are affected by CVE-2026-34628?

Adobe InDesign Desktop versions 20.5.2 and 21.2 contain a heap-based buffer overflow vulnerability that enables arbitrary code execution when users open malicious documents, posing a direct threat to…

How to fix or mitigate CVE-2026-34628?

24 hours: Inventory all Adobe InDesign installations (versions 20.5.2, 21.2, and earlier) across the organization and disable external document handling where operationally feasible; notify design and publishing teams to avoid opening files from untrusted sources. 7 days: Implement strict file-source validation policies requiring all external InDesign documents (.indd, .idml) to be scanned and verified before opening; configure application sandboxing or run InDesign in isolated virtual environments for high-risk document processing. 30 days: Establish a vendor communication protocol to obtain patch notification immediately upon release; evaluate migration to patched versions or alternative design software as alternatives become available; conduct user security awareness training on file handling risks.

Indesign Desktop CVE-2026-34628

EUVD-2026-22651 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 adobe

GHSA-qgg3-vppq-vr2q

RCE Buffer Overflow Heap Overflow Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 16, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 19:38 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 17:46 euvd

EUVD-2026-22651

Analysis Generated

Apr 14, 2026 - 17:46 vuln.today

CVE Published

Apr 14, 2026 - 17:05 nvd

HIGH 7.8

DescriptionCVE.org

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high impact to confidentiality, integrity, and availability when users open malicious files. The vulnerability requires local access and user interaction (opening a crafted document), with no authentication barriers (CVSS PR:N). No public exploit identified at time of analysis, and CISA SSVC framework rates this as non-exploited with total technical impact but not automatable, indicating targeted attack potential rather than mass exploitation risk.

Technical ContextAI

This vulnerability stems from CWE-122 (heap-based buffer overflow), a memory corruption class where InDesign Desktop's file parsing logic fails to properly validate buffer boundaries when processing specially crafted document files. Heap overflows occur when data writes exceed allocated memory regions in the heap segment, potentially overwriting adjacent memory structures including function pointers and control data. The affected CPE (cpe:2.3:a:adobe:indesign_desktop) encompasses all versions through 21.2, indicating the vulnerability likely exists in core document processing components shared across InDesign's desktop publishing platform. Unlike stack-based overflows, heap exploitation typically requires more sophisticated techniques but offers attackers greater control over memory layout and execution flow, enabling reliable code execution in the current user's security context.

RemediationAI

Vendor-released patch details are available through Adobe Security Bulletin APSB26-32 at https://helpx.adobe.com/security/products/indesign/apsb26-32.html. Organizations should immediately consult this advisory for exact patched versions superseding the vulnerable 20.5.2 and 21.2 releases. Adobe typically distributes InDesign updates through the Creative Cloud desktop application, enabling automated deployment in managed environments. Until patching is complete, implement defense-in-depth controls: restrict InDesign file sources to trusted repositories, educate users about malicious document risks, and consider application sandboxing or virtualization to contain potential exploitation. Disable automatic file preview features that might trigger parsing without explicit user action. For high-security environments, temporarily restrict InDesign usage to isolated systems until patches are verified and deployed across the enterprise.