EUVD-2026-35775
GHSA-p34q-cvx5-m2mv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious INDD/IDML file
-
DeliveryDeliver via phishing or shared asset repo
-
ExploitVictim opens file in InDesign
-
ExecutionStack buffer overflow during parsing
-
PersistHijack control flow and execute payload
-
ImpactOperate as current user on host
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Stack buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted InDesign document on a vulnerable installation of Adobe InDesign Desktop 21.3, 20.5.3 or earlier; per the CVSS vector (AV:L/AC:L/PR:N/UI:R) the attack vector is local file open, no prior authentication to the application is needed, and user interaction (opening the file) is mandatory. There is no network-listening service involved, so remote exploitation occurs only via file delivery (email attachment, shared drive, download, USB) and conversion of the user to open the document. Limiting factors that reduce realistic risk: required user interaction, the file format being non-default for most users outside design workflows, the per-user (S:U, non-elevated) impact scope, and the absence of any known public exploit. |
| Impact | The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H yields 7.8 (High) and reflects a classic client-side file-parsing flaw: the attacker needs no privileges but must convince the user to open a file, so reach depends on social engineering rather than network-exposed services. KEV status is not asserted and no EPSS score is provided in the input, and the only reference is the Adobe advisory itself - there is no public exploit identified at time of analysis. SSVC-style assessment: exploitation status is none, automatability is low (requires UI), but technical impact is total on the affected host. Realistic priority is moderate for general enterprise endpoints and higher for creative/marketing teams who routinely open externally supplied INDD/IDML files; this is a real patch-soon issue rather than emergency, absent later evidence of in-the-wild use. |
| Exploit ScenarioDerived | An attacker emails a marketing or design team member an INDD or IDML file masquerading as a vendor template, brand-guide update, or client deliverable; when the recipient double-clicks the file, InDesign's parser overruns a stack buffer and the crafted payload achieves code execution as the logged-in user. The foothold provides full read/write to the user's documents and credentials and can pivot into design pipelines and shared asset stores. No public exploit is identified at time of analysis, so realistic delivery currently depends on a private exploit developer. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow triggered when a victim opens a malicious document file. Exploitation runs in the context of the current user and requires user interaction, with no public exploit identified at time of analysis. The issue was reported by Adobe and addressed in security bulletin APSB26-58.
RemediationAI
Apply the vendor-released patch by upgrading Adobe InDesign Desktop to the fixed releases published in Adobe security bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html); specifically, move 21.x installs beyond 21.3 and 20.x installs beyond 20.5.3 to the versions listed in that bulletin. Where immediate patching is not possible, restrict opening of InDesign files (INDD, IDML, INDT) received from external or untrusted sources, route inbound creative assets through a sandboxed review workstation, and use application-allowlisting or AppLocker/Gatekeeper policies to prevent InDesign from spawning unexpected child processes - note the trade-off that blocking child processes can break legitimate scripting and export workflows. Endpoint EDR rules that alert on InDesign-spawned shells or LOLBins provide useful detection while patching is rolled out.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Adobe InDesign is a desktop publishing application that parses complex proprietary and interchange document formats (such as INDD, IDML, and embedded resource streams). The vulnerability falls under CWE-121 (Stack-based Buffer Overflow), indicating that a fixed-size stack buffer is written past its bounds while parsing attacker-controlled fields inside a malicious file. On modern Windows and macOS platforms this class of bug typically corrupts the saved return address or adjacent stack metadata, enabling control-flow hijacking subject to mitigations such as stack canaries, DEP, and ASLR. The CPE cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* confirms the Adobe InDesign Desktop product line as the sole affected component.
Know when Indesign Desktop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
DescriptionCVE.org
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe InDesign Desktop versions 21.3 and earlier contain a vulnerability allowing attackers to execute code on user machines through malicious design files. Users across the organization are at risk of system compromise and intellectual property theft through document-based attack delivery. No vendor patch is currently available, necessitating immediate operational controls to restrict document handling.
Restrict InDesign document handling to internally-generated, pre-approved files; implement application sandboxing or virtualization for InDesign workflows; enforce email filtering to block .indd attachments from external senders; deploy EDR tooling to monitor for buffer overflow exploitation signatures; conduct user awareness training on untrusted document sources.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A stack-based buffer overflow occurs when a program writes more data to a buffer located on the stack than it was allocated to hold.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Exploit-DB