EUVD-2026-35786
GHSA-vrf2-x73g-j53m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
InCopy versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe InCopy 21.3, 20.5.3, and earlier allows attackers to run code as the current user when a victim opens a maliciously crafted file. The flaw stems from an out-of-bounds write (CWE-787) in file parsing logic, carries a CVSS 7.8 (local, user-interaction required), and has no public exploit identified at time of analysis. Adobe published advisory APSB26-59 addressing the issue.
Technical ContextAI
Adobe InCopy is a professional word processing application tightly integrated with Adobe InDesign for collaborative editorial workflows, parsing complex proprietary document formats (ICML, INCX, IDML fragments) and embedded media. The root cause is CWE-787 (Out-of-bounds Write), a memory corruption class where the application writes data past the bounds of an allocated buffer - typically due to insufficient length validation while parsing attacker-controlled fields in a document. According to the CPE (cpe:2.3:a:adobe:incopy:*:*:*:*:*:*:*:*), the issue spans the InCopy product line broadly, with Adobe listing the 2025 (21.x) and 2024 (20.x) release trains as affected. Out-of-bounds writes in document parsers are a recurring root cause for code execution vulnerabilities in Adobe's Creative Cloud desktop suite.
RemediationAI
Apply the patch available per Adobe advisory APSB26-59 (https://helpx.adobe.com/security/products/incopy/apsb26-59.html) by upgrading to the fixed InCopy releases listed by the vendor - exact fixed build numbers should be taken directly from that bulletin, as they are not enumerated in the CVE record itself. Where immediate patching is not possible, compensating controls include configuring email and file-sharing gateways to scan or block InCopy file types (.icml, .incx, .indd fragments) from untrusted senders, training editorial users to open files only from known sources, and running InCopy under a standard (non-administrator) account so a successful exploit is constrained to that user's privileges; these controls limit but do not eliminate the risk and may disrupt legitimate collaborative editorial workflows that depend on receiving InCopy assignment files externally.
Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. Rate
InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Heap-based buffer overflow vulnerability in Adobe InCopy versions 20.2, 19.5.3 and earlier that allows arbitrary code ex
CVE-2025-30327 is an integer overflow vulnerability in Adobe InCopy that enables arbitrary code execution with the privi
InCopy versions 20.3, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in
InCopy versions 20.3, 19.5.3 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could res
InCopy versions 20.3, 19.5.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Arbitrary code execution in Adobe InCopy versions 21.0, 19.5.5 and earlier through a heap-based buffer overflow when use
Arbitrary code execution in Adobe InCopy versions 21.3, 20.5.3 and earlier occurs when a user opens a maliciously crafte
Stack-based buffer overflow in Adobe InCopy 21.3, 20.5.3 and earlier enables arbitrary code execution in the context of
Arbitrary code execution in Adobe InCopy 20.5.2, 21.2 and earlier allows unauthenticated local attackers to execute mali
Out-of-bounds read in Adobe InCopy 20.5.2, 21.2 and earlier allows arbitrary code execution when users open malicious fi
Same weakness CWE-787 – Out-of-bounds Write
View allShare
External POC / Exploit Code
Leaving vuln.today