What is the CVSS score of CVE-2026-34696?

CVE-2026-34696 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign are affected by CVE-2026-34696?

Adobe InDesign Desktop versions 21.3 and 20.5.3 contain a use-after-free vulnerability (CVE-2026-34696) enabling arbitrary code execution when users open maliciously crafted documents, potentially…

How to fix or mitigate CVE-2026-34696?

Within 24 hours: Inventory all systems running Adobe InDesign 21.3, 20.5.3, or earlier; immediately restrict opening documents from untrusted external sources; send urgent security notice to all InDesign users. Within 7 days: Disable or uninstall InDesign on non-essential systems; enforce document origin verification and implement application sandboxing where possible; provide user training on malicious document risks. Within 30 days: Monitor Adobe security advisories daily for patch release; conduct risk assessment for business-critical InDesign workflows; establish rapid deployment procedures for when vendor patch becomes available.

Adobe InDesign CVE-2026-34696

EUVD-2026-35780 HIGH

Use After Free (CWE-416)

2026-06-09 adobe

GHSA-8x9r-pg87-r424

RCE Denial Of Service Use After Free Memory Corruption Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:58 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition triggered when a user opens a maliciously crafted document, allowing an attacker to run code with the privileges of the logged-in user. The flaw is reported by Adobe with a CVSS 3.1 base score of 7.8 and tagged for RCE, denial of service, and memory corruption, but there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected product is Adobe InDesign Desktop (cpe:2.3:a:adobe:indesign_desktop) on the standard Creative Cloud distribution channel. CWE-416 (Use After Free) means the application continues to reference memory that has already been released by the allocator; when the freed region is reclaimed for attacker-controlled data, dereferencing the dangling pointer can corrupt object state or hijack control flow. In a desktop document-parsing context this typically manifests inside the parser that processes the proprietary INDD/IDML or embedded object streams, where lifetime management between cached object graphs and rendering structures is complex.

RemediationAI

Apply the vendor patch documented in Adobe Security Bulletin APSB26-58 at https://helpx.adobe.com/security/products/indesign/apsb26-58.html - update InDesign Desktop past 21.3 and 20.5.3 through the Creative Cloud desktop application or enterprise admin console; exact fix versions should be taken from the Adobe advisory rather than inferred. Where immediate patching is not possible, restrict opening of InDesign documents from untrusted sources, route inbound INDD/IDML files through an isolated review workstation, and disable preview handlers or auto-open integrations in mail and collaboration clients to prevent inadvertent triggering, accepting the trade-off that creative teams lose convenience features and may need a controlled intake workflow.