What is the CVSS score of CVE-2026-34701?

CVE-2026-34701 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign Desktop are affected by CVE-2026-34701?

Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) contains an arbitrary code execution vulnerability triggered when users open maliciously crafted design files; no public exploit has been…

How to fix or mitigate CVE-2026-34701?

Within 24 hours: Inventory all Adobe InDesign Desktop installations documenting affected versions (21.3, 20.5.3 and earlier); alert design and marketing teams to avoid opening .indd/.idml files from external or untrusted sources; disable file preview for InDesign documents in operating system settings. Within 7 days: Establish formal security intake process for external InDesign files requiring isolated testing; evaluate alternative design software (Affinity Publisher, QuarkXPress); segregate systems processing external files to sandboxed environments if possible. Within 30 days: Monitor Adobe Security Advisory APSB26-58 for patch release; immediately deploy any Adobe patch to all affected InDesign Desktop versions; if no patch emerges, implement mandatory sandboxed execution (Windows Sandbox or virtual machine) for all external InDesign document processing.

Adobe InDesign Desktop CVE-2026-34701

EUVD-2026-35784 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 adobe

GHSA-2vq7-33x9-h9x9

RCE Buffer Overflow Heap Overflow Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:55 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer overflow triggered when a victim opens a maliciously crafted file. The flaw runs code in the security context of the current user and requires user interaction, with no public exploit identified at time of analysis. Adobe has published advisory APSB26-58 addressing the issue.

Technical ContextAI

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), where an attacker-controlled length or out-of-bounds write into a heap-allocated buffer corrupts adjacent heap metadata or object pointers. In Adobe InDesign Desktop (cpe:2.3:a:adobe:indesign_desktop), this class of bug typically arises in the parsers that handle complex document formats (INDD, IDML, embedded images, fonts, or linked assets), where malformed structures cause size miscalculations during allocation or copy operations. Successful corruption of heap chunks can be leveraged to hijack control flow and achieve arbitrary code execution within the InDesign process.

RemediationAI

The primary remediation is to apply the patched InDesign Desktop builds released by Adobe in security bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html); upgrade installations running 21.3, 20.5.3, or earlier to the corresponding fixed versions listed there via the Creative Cloud desktop app. Because exploitation requires opening a malicious file, interim compensating controls include instructing users not to open InDesign documents (INDD, IDML) from untrusted or unverified sources, routing inbound creative files through an isolated review workstation or sandbox, and using email/file-gateway policies to quarantine attachments with these extensions - the trade-off is operational friction for design teams that routinely exchange files with external collaborators. Running InDesign under a standard (non-administrator) account limits the blast radius of successful exploitation but does not prevent code execution in the user context.