What is the CVSS score of CVE-2026-34704?

CVE-2026-34704 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

InDesign Desktop CVE-2026-34704

EUVD-2026-35782 MEDIUM

NULL Pointer Dereference (CWE-476)

2026-06-09 adobe

GHSA-rc56-w2j5-3x6q

Denial Of Service Null Pointer Dereference Indesign Desktop

5.5

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 19:59 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

NULL Pointer Dereference in Adobe InDesign Desktop versions 21.3 and 20.5.3 and earlier allows a local attacker to crash the application by delivering a crafted document file that a victim must open, resulting in a denial-of-service condition with no confidentiality or integrity impact. Exploitation is constrained by mandatory user interaction (UI:R) and a local attack vector (AV:L), significantly limiting real-world risk beyond targeted social-engineering scenarios involving design professionals. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Technical ContextAI

CWE-476 (NULL Pointer Dereference) arises when application code attempts to dereference a pointer that has not been assigned a valid memory address, causing an immediate process crash rather than exploitable memory corruption. In InDesign Desktop's document parsing pipeline, a specially crafted file can trigger this condition during parsing or rendering of file contents. The CPE identifier cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* confirms this affects Adobe's desktop publishing application across both the 20.x and 21.x release trains. The CVSS vector AV:L confirms the vulnerability is exercised locally - the malicious file must be present on and opened from the local filesystem or a mapped path, not exploitable over the network directly. Because the scope is unchanged (S:U) and impact is limited to availability (A:H, C:N, I:N), the parser flaw does not cross privilege boundaries or expose data.

RemediationAI

The primary fix is to apply the patch documented in Adobe Security Bulletin APSB26-58 at https://helpx.adobe.com/security/products/indesign/apsb26-58.html; the exact patched release version is not specified in the supplied intelligence data and must be confirmed directly from that advisory before deployment. As an interim compensating control, users should avoid opening InDesign files received from untrusted, unexpected, or external sources until patching is complete, since exploitation is entirely dependent on a victim opening a malicious file. Organizations operating publishing workflows may enforce file-origin policies - for example, restricting InDesign document ingestion to files sourced from internal asset management systems or verified collaborators - which meaningfully reduces exposure without interrupting legitimate operations. Disabling automatic file preview or 'open recent' features that might silently parse files on application launch is an additional low-friction precaution with minimal workflow impact.