What is the CVSS score of CVE-2026-34703?

CVE-2026-34703 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

InDesign Desktop CVE-2026-34703

EUVD-2026-35779 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-09 adobe

GHSA-xg7g-jmmf-pmrh

Denial Of Service Null Pointer Dereference Adobe Indesign Desktop

5.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 20:00 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

NULL Pointer Dereference in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier enables a denial-of-service condition by crashing the application when a victim opens a specially crafted malicious file. The vulnerability carries no confidentiality or integrity impact - availability is the sole affected component. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog, limiting its urgency relative to higher-severity Adobe vulnerabilities.

Technical ContextAI

CWE-476 (NULL Pointer Dereference) describes a condition where application code attempts to dereference a pointer that has not been initialized or has been set to NULL, causing a segmentation fault or unhandled exception that terminates the process. In the context of InDesign Desktop (CPE: cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:*), this flaw resides in the document parsing or rendering subsystem, where a malformed or adversarially crafted InDesign file can supply input that causes the parser to operate on a NULL pointer. EUVD-2026-35779 corroborates the affected range as versions 0 through 20.5.3, with the NVD description additionally identifying the 21.x branch up to 21.3. Adobe reported and disclosed this vulnerability themselves via advisory APSB26-58, suggesting discovery through their internal security review process rather than external researcher submission.

RemediationAI

The primary remediation is to apply the patch released by Adobe via advisory APSB26-58, available at https://helpx.adobe.com/security/products/indesign/apsb26-58.html. The exact patched version number is not confirmed in the provided input data and must be verified directly from the APSB26-58 advisory before deployment. As a compensating control where immediate patching is not possible, organizations should instruct InDesign Desktop users not to open InDesign document files (.indd, .indl, .indt, .indb) received from untrusted or unexpected sources, and to route any unsolicited creative files through a sandboxed preview environment or IT review process before opening in the live application. This social-engineering mitigation eliminates the required user interaction prerequisite without requiring downtime, though it relies on user compliance and does not address the underlying code defect.