Adobe InDesign CVE-2026-34698

Exploitation requires the victim to open a maliciously crafted InDesign document (such as an .indd or .idml file) in a vulnerable InDesign Desktop build (21.3 or earlier in the 21.x line, 20.5.3 or earlier in the 20.x line); the CVSS vector AV:L/UI:R confirms local file-open delivery and mandatory user interaction. No special configuration, plugin, or elevated privilege is required - InDesign's default file-parsing behavior is the attack surface - but the attacker must successfully social-engineer the file into the victim's hands and convince them to open it, and code executes only at the current user's privilege level (S:U), so an attacker cannot directly gain SYSTEM/root without a separate local privilege escalation.

The CVSS 3.1 base score of 7.8 with vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflects a local attack vector that requires user interaction - consistent with the description's requirement that a victim open a malicious file - and yields full confidentiality, integrity, and availability impact at the user's privilege level. There is no EPSS, KEV, or SSVC data provided, and no public exploit identified at time of analysis, so this is not currently a wormable, internet-exposed threat; risk is driven by social-engineering delivery (phishing with attached INDD/IDML files) to designers and publishing teams who routinely open third-party files. Real-world priority is moderate-to-high for organizations with creative/marketing staff but lower for environments where InDesign is not deployed; absence of KEV listing and EPSS telemetry means urgency should be derived from exposure rather than confirmed in-the-wild activity.

An attacker emails a designer a crafted .indd or .idml file disguised as a client brief, brand asset pack, or freelancer deliverable; when the recipient double-clicks it, InDesign's parser triggers the heap overflow and executes shellcode that drops a loader running as the logged-in user. Because the user typically has access to shared marketing drives, brand assets, and SSO sessions, the attacker pivots to data theft or staging further intrusion. No public exploit identified at time of analysis, but the bug class is well-understood and historically reliable in Adobe desktop apps.