Adobe InDesign CVE-2026-34695

Victim must open a malicious InDesign document (INDD/IDML or related supported format) in Adobe InDesign Desktop 21.3, 20.5.3 or earlier - the CVE description explicitly requires that 'a victim must open a malicious file,' matching CVSS UI:R. Exploitation is bounded to the local context (AV:L) meaning the attacker cannot trigger the bug remotely without first delivering the file via email, web download, shared drive, or removable media; code executes only with the privileges of the user running InDesign (S:U), so administrative rights are not required by the attacker but also not gained by the exploit alone. No special non-default configuration is needed - any installation of the listed versions opening the crafted file is vulnerable.

The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a classic client-side file-parsing bug: local attack vector because the malicious file must be processed on the victim host, low complexity, no privileges required by the attacker, but user interaction (opening the file) is mandatory. There is no EPSS score, KEV listing, or POC indicator in the provided intelligence, so real-world risk is materially lower than a network-reachable RCE of similar score. The likely targeting profile is spear-phishing of creative/publishing staff with weaponized INDD files rather than mass exploitation; prioritize patching on endpoints used by designers and editorial teams, but this is not an emergency comparable to actively-exploited server-side bugs.

An attacker emails a graphic designer a tailored INDD or IDML file masquerading as a vendor brief or freelance brand kit; when the recipient double-clicks the attachment, InDesign parses the malformed structure, the stack buffer overflows, and shellcode runs as the logged-in user. The attacker then steals saved cloud credentials and intellectual property from the user's profile or pivots into the corporate network. No public exploit identified at time of analysis.