What is the CVSS score of CVE-2026-34698?

CVE-2026-34698 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign are affected by CVE-2026-34698?

A critical vulnerability in Adobe InDesign Desktop (versions 21.3 and earlier) enables arbitrary code execution when users open malicious document files, creating a direct threat to design teams and…

How to fix or mitigate CVE-2026-34698?

24 hours: Inventory all Adobe InDesign 21.3, 20.5.3, and earlier installations; restrict .indd file opening from untrusted external sources via security policy; notify design teams of exploitation risk. 7 days: Deploy email security rules to block or quarantine .indd attachments from external domains; disable InDesign cloud collaboration features; segment creative workstations from critical business systems. 30 days: Establish rapid deployment process for APSB26-58 patch once released by Adobe; evaluate alternative design tools or air-gapped environments for processing untrusted documents; validate completeness of InDesign inventory and policy enforcement.

Adobe InDesign CVE-2026-34698

EUVD-2026-35778 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 adobe

GHSA-xhp8-2xff-53wx

Heap Overflow Buffer Overflow RCE Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:57 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE-122) triggered when a victim opens a maliciously crafted document file. The flaw runs code in the context of the current user and requires user interaction, with no public exploit identified at time of analysis. Adobe published advisory APSB26-58 addressing the issue.

Technical ContextAI

Adobe InDesign Desktop is a professional desktop publishing application that parses a wide range of proprietary and embedded file formats (INDD, IDML, and embedded fonts/images). CWE-122 (Heap-Based Buffer Overflow) typically arises when the application reads attacker-controlled length or count fields from a parsed file structure and writes beyond an allocated heap chunk, corrupting adjacent allocator metadata or object pointers. In native C/C++ parsers like InDesign's, such corruption can be steered into hijacking a virtual function pointer or freelist entry, enabling arbitrary code execution. The CPE cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* confirms the desktop application is the affected component, not the server or cloud services.

RemediationAI

Apply the Adobe-released patch by updating Adobe InDesign Desktop to the fixed versions listed in advisory APSB26-58 at https://helpx.adobe.com/security/products/indesign/apsb26-58.html - update the 21.x branch to the post-21.3 release and the 20.x branch to the post-20.5.3 release identified by Adobe, deploying via the Creative Cloud Desktop client or enterprise Admin Console. Until patching is complete, instruct users not to open InDesign files (.indd, .idml, .indt, templates) received from untrusted or unexpected sources, route inbound creative assets through a sandboxed review workstation, and consider blocking these file types at the email gateway for non-creative staff; the trade-off is friction for legitimate vendor and contractor file exchange. Standard endpoint hardening (running InDesign as a non-administrative user, enabling OS exploit mitigations such as ASLR/CFG on Windows and Hardened Runtime on macOS) reduces but does not eliminate the impact of successful exploitation.