What is the CVSS score of CVE-2026-34702?

CVE-2026-34702 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign Desktop are affected by CVE-2026-34702?

Adobe InDesign Desktop versions 21.3 and earlier contain a vulnerability (CVE-2026-34702) enabling arbitrary code execution when users open specially crafted design documents.

How to fix or mitigate CVE-2026-34702?

Within 24 hours: Audit all InDesign installations to identify versions 21.3, 20.5.3, or earlier; issue alert restricting document opening from untrusted external sources. Within 7 days: Implement mandatory file source verification policy; provide security awareness training on document-based attacks to design teams; establish monitoring for suspicious InDesign process execution. Within 30 days: Establish communication with Adobe for patch availability timeline; develop upgrade plan to patched version upon release; evaluate network isolation for design workstations.

Adobe InDesign Desktop CVE-2026-34702

EUVD-2026-35773 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-06-09 adobe

GHSA-22v9-mchf-h83w

RCE Buffer Overflow Stack Overflow Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:55 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow triggered when a user opens a malicious document. Successful exploitation runs attacker-controlled code in the context of the current user, but requires social engineering since the attack vector is local and user interaction is mandatory. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Adobe InDesign Desktop is a professional desktop publishing application that parses complex proprietary document formats (INDD, IDML) along with embedded image and font resources. The flaw is classified as CWE-121 (Stack-based Buffer Overflow), meaning a fixed-size buffer on the call stack is written past its bounds - typically during parsing of malformed length fields, structure headers, or embedded objects within an InDesign file. Stack overflows of this class can corrupt the saved return address or adjacent stack frames, allowing redirection of execution flow to attacker-controlled shellcode or ROP gadgets, subject to mitigations such as stack cookies, DEP, and ASLR enforced by the host OS.

RemediationAI

Apply the Adobe-released update referenced in security bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html), which supersedes InDesign Desktop 21.3 and 20.5.3; consult the bulletin for the exact patched version numbers for each track since the input data does not include them verbatim. Until patching is complete, instruct users not to open InDesign documents (.indd, .idml) received from untrusted or unsolicited sources, route inbound design files through a sandboxed review workstation, and consider enforcing application allow-listing or attachment filtering on these extensions at the email gateway - the trade-off is friction for legitimate design-agency collaboration. Endpoint EDR rules that alert on InDesign spawning shells, scripting hosts, or unusual child processes provide a detection layer while patches roll out.