EUVD-2026-22652
GHSA-wp47-6c9c-57m5
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
5DescriptionCVE.org
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution with high integrity and confidentiality impact when users open specially crafted malicious files. No public exploit identified at time of analysis. CVSS 7.8 reflects local attack vector requiring user interaction but no authentication, with complete system compromise potential in user context. EPSS risk data not available; exploitation requires social engineering to deliver malicious InDesign document.
Technical ContextAI
This vulnerability exploits a CWE-122 heap-based buffer overflow in Adobe InDesign Desktop's file parsing routines. Heap overflows occur when a program writes data beyond allocated heap memory boundaries, potentially corrupting adjacent memory structures and enabling control-flow hijacking. The affected product (CPE: cpe:2.3:a:adobe:indesign_desktop) processes complex document formats that require extensive parsing of untrusted input. When InDesign processes a maliciously crafted file, insufficient bounds checking allows an attacker to overflow heap buffers during document rendering or parsing operations, overwriting critical memory structures such as function pointers or object metadata. This memory corruption can be leveraged to redirect program execution to attacker-controlled code, achieving arbitrary code execution within the security context of the victim user running InDesign. All versions through 21.2 contain the vulnerable parsing code, affecting both the 20.x and 21.x release branches.
RemediationAI
Users should immediately update Adobe InDesign Desktop to the patched versions specified in Adobe Security Bulletin APSB26-32 available at https://helpx.adobe.com/security/products/indesign/apsb26-32.html. Adobe typically releases patches for both current and previous major versions, so users on 20.x and 21.x branches should apply their respective updates. Until patching is complete, organizations should implement defense-in-depth controls including restricting InDesign file sources to trusted repositories only, enabling Protected View or sandboxing features if available in Adobe's enterprise deployment tools, conducting security awareness training emphasizing risks of opening unsolicited InDesign files, and deploying email gateway scanning to block suspicious .indd and related file attachments. Network segmentation and principle of least privilege reduce post-exploitation impact by limiting lateral movement if user workstations are compromised. For critical environments unable to patch immediately, consider temporarily disabling InDesign or restricting usage to air-gapped systems until updates are deployed.
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today