Indesign Desktop CVE-2026-34629

The victim must open a malicious file in Adobe InDesign Desktop versions 20.5.2, 21.2, or earlier. No special configuration required; default installations are vulnerable. Local attacker or remote attacker sending crafted file via email/web.

Real-world risk is moderate despite the 7.8 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates local attack vector with low complexity but mandatory user interaction, creating a significant exploitation barrier. The PR:N designation confirms no authentication required once file access is achieved, and S:U (unchanged scope) means the compromise is limited to the InDesign process security context. The complete CIA triad impact (C:H/I:H/A:H) demonstrates full system compromise potential within user privileges. However, successful exploitation depends entirely on social engineering effectiveness-attackers must convince users to open malicious InDesign files via phishing, watering hole attacks, or malicious downloads. No CISA KEV listing indicates absence of confirmed active exploitation campaigns. Without EPSS data, we lack probabilistic exploitation forecasting, but the combination of required user interaction, local attack vector, and absence of public POC suggests this is not an immediate mass-exploitation risk. Primary risk exists in targeted attacks against creative professionals, publishing organizations, or high-value individuals where attackers invest in convincing file delivery. Organizations with robust email filtering, user security awareness training, and application sandboxing significantly reduce exposure. This is a patch-priority issue for InDesign users but not an enterprise-wide emergency requiring immediate crisis response.

An attacker crafts a malicious InDesign document exploiting the heap overflow vulnerability and distributes it via spear-phishing email to graphic designers at a target publishing company, disguised as a legitimate client project file or template. When a victim opens the weaponized .indd file in their vulnerable InDesign Desktop installation, the malformed data triggers the heap-based buffer overflow during document parsing, corrupting memory structures and hijacking execution flow to attacker-supplied shellcode embedded in the file. The shellcode executes with the victim's user privileges, establishing persistence through scheduled tasks, exfiltrating intellectual property from the user's accessible file shares, and potentially deploying additional malware for lateral network movement.