What is the CVSS score of CVE-2026-34700?

CVE-2026-34700 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign Desktop are affected by CVE-2026-34700?

Adobe InDesign, a core tool for design and publishing teams, contains a code execution vulnerability (CVE-2026-34700) triggered through maliciously crafted documents, threatening the integrity of…

How to fix or mitigate CVE-2026-34700?

Within 24 hours: Inventory all systems running Adobe InDesign versions 21.3, 20.5.3 and earlier; issue mandatory policy prohibiting opening InDesign documents from external or untrusted sources; activate email gateway filtering to block .indd and .idml attachments from external senders. Within 7 days: Deploy endpoint detection & response (EDR) rules to monitor InDesign process behavior and child process spawning; evaluate InDesign alternatives or sandboxing solutions for non-critical workflows. Within 30 days: Monitor Adobe security advisories for patch release (expected in versions 21.4 or later) and prepare rapid deployment plan; maintain daily vendor monitoring.

Adobe InDesign Desktop CVE-2026-34700

EUVD-2026-35781 HIGH

Out-of-bounds Write (CWE-787)

2026-06-09 adobe

GHSA-p36q-gh39-3mgh

RCE Buffer Overflow Memory Corruption Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:56 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds write triggered when a user opens a maliciously crafted document, allowing attacker code to run with the privileges of the current user. The flaw carries a CVSS 7.8 (High) rating, requires victim interaction, and no public exploit identified at time of analysis.

Technical ContextAI

Adobe InDesign Desktop is a professional desktop publishing application that parses a wide variety of complex file formats including INDD, IDML, and embedded image/font resources. The root cause is CWE-787 (Out-of-bounds Write), a memory-corruption class bug in which the application writes past the bounds of an allocated buffer - typically during parsing of attacker-controlled fields in an InDesign document. CPE data confirms cpe:2.3:a:adobe:indesign_desktop is the sole affected product family, and the bug is tagged as RCE / Buffer Overflow / Memory Corruption, consistent with a parser-side memory safety defect that can be steered into control-flow hijack.

RemediationAI

The primary fix is to upgrade Adobe InDesign Desktop to the patched releases listed in Adobe security bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html); Patch available per vendor advisory, with exact fixed build numbers documented in that bulletin and deployable via Adobe Creative Cloud's update mechanism. Until updates are deployed, compensating controls include instructing users not to open InDesign documents (.indd, .idml) from untrusted senders, blocking these extensions at the email gateway or quarantining them for sandbox detonation (trade-off: disrupts legitimate designer collaboration), opening suspect files only inside a non-privileged VM or sandboxed user account to contain code execution, and ensuring endpoint protection and OS-level exploit mitigations (DEP, ASLR, CFG) are enforced on workstations running InDesign to raise the cost of memory-corruption exploitation.