What is the CVSS score of CVE-2026-34697?

CVE-2026-34697 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign are affected by CVE-2026-34697?

Adobe InDesign Desktop versions 21.3 and earlier contain a vulnerability allowing attackers to execute code on user machines through malicious design files.

How to fix or mitigate CVE-2026-34697?

Within 24 hours: Complete inventory of InDesign installations and user distribution; disable opening of InDesign documents from external sources and implement email gateway filtering for .indd file attachments. Within 7 days: Deploy application sandboxing for InDesign where feasible; conduct targeted user security training on document source verification. Within 30 days: Monitor Adobe security advisories for patch release; develop upgrade plan and execute staged deployment to patched InDesign versions upon availability.

Adobe InDesign CVE-2026-34697

EUVD-2026-35775 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 adobe

GHSA-p34q-cvx5-m2mv

Stack Overflow Buffer Overflow RCE Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:57 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow triggered when a victim opens a malicious document file. Exploitation runs in the context of the current user and requires user interaction, with no public exploit identified at time of analysis. The issue was reported by Adobe and addressed in security bulletin APSB26-58.

Technical ContextAI

Adobe InDesign is a desktop publishing application that parses complex proprietary and interchange document formats (such as INDD, IDML, and embedded resource streams). The vulnerability falls under CWE-121 (Stack-based Buffer Overflow), indicating that a fixed-size stack buffer is written past its bounds while parsing attacker-controlled fields inside a malicious file. On modern Windows and macOS platforms this class of bug typically corrupts the saved return address or adjacent stack metadata, enabling control-flow hijacking subject to mitigations such as stack canaries, DEP, and ASLR. The CPE cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* confirms the Adobe InDesign Desktop product line as the sole affected component.

RemediationAI

Apply the vendor-released patch by upgrading Adobe InDesign Desktop to the fixed releases published in Adobe security bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html); specifically, move 21.x installs beyond 21.3 and 20.x installs beyond 20.5.3 to the versions listed in that bulletin. Where immediate patching is not possible, restrict opening of InDesign files (INDD, IDML, INDT) received from external or untrusted sources, route inbound creative assets through a sandboxed review workstation, and use application-allowlisting or AppLocker/Gatekeeper policies to prevent InDesign from spawning unexpected child processes - note the trade-off that blocking child processes can break legitimate scripting and export workflows. Endpoint EDR rules that alert on InDesign-spawned shells or LOLBins provide useful detection while patching is rolled out.