What is the CVSS score of CVE-2026-34695?

CVE-2026-34695 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign are affected by CVE-2026-34695?

Adobe InDesign Desktop versions 21.3 and 20.5.3 or earlier contain an arbitrary code execution vulnerability (CVE-2026-34695) triggered when users open maliciously crafted documents, potentially…

How to fix or mitigate CVE-2026-34695?

24 hours: Identify and inventory all InDesign Desktop installations on versions 21.3 or earlier; notify InDesign users and advise against opening documents from untrusted sources pending patch availability. 7 days: Implement document restrictions blocking InDesign file opening from external email sources where operationally feasible; conduct security awareness communication on document-based attack vectors; establish process for users to report suspicious files. 30 days: Continuously monitor Adobe security bulletins (APSB26-58 updates) for patch availability; develop and stage deployment plan for immediate rollout when patch is released; consider application controls restricting InDesign execution for departments with lowest operational need.

Adobe InDesign CVE-2026-34695

EUVD-2026-35783 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 adobe

GHSA-2cm9-pghr-m2c8

Stack Overflow Buffer Overflow RCE Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:58 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously crafted document, triggering a stack-based buffer overflow (CWE-121) that runs attacker code in the context of the current user. Adobe issued advisory APSB26-58 for this issue; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

Adobe InDesign Desktop is a professional desktop publishing application that parses numerous complex file formats (INDD, IDML, IDMS, plus embedded image/font assets). CWE-121 (Stack-based Buffer Overflow) indicates the flaw lives in a parser routine that writes attacker-controlled data past the bounds of a fixed-size stack buffer, allowing corruption of saved return addresses, frame pointers, or adjacent locals. The CPE cpe:2.3:a:adobe:indesign_desktop confirms the desktop client (not Server or cloud variants) is affected. Successful exploitation on modern Windows/macOS hosts typically requires bypassing stack canaries, DEP, and ASLR - feasible but non-trivial - and the resulting code executes inside the InDesign process under the logged-in user's token.

RemediationAI

Apply the patched InDesign Desktop releases identified in Adobe Security Bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html) - update the 21.x branch past 21.3 and the 20.x branch past 20.5.3 using Creative Cloud Desktop or enterprise deployment tooling; exact fix version numbers should be confirmed against the linked advisory. Until patching completes, instruct users not to open INDD, IDML, or related InDesign files received from untrusted sources, enforce attachment scanning and Mark-of-the-Web on email/web downloads so Windows Protected View / macOS Gatekeeper warnings fire, and consider blocking InDesign document MIME types at the email gateway for non-creative user groups (trade-off: legitimate external collaboration with designers will be disrupted). Running InDesign as a standard user rather than local admin limits but does not eliminate impact, since code still executes with the user's data access.