EUVD-2026-35786
GHSA-vrf2-x73g-j53m
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
InCopy versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe InCopy 21.3, 20.5.3, and earlier allows attackers to run code as the current user when a victim opens a maliciously crafted file. The flaw stems from an out-of-bounds write (CWE-787) in file parsing logic, carries a CVSS 7.8 (local, user-interaction required), and has no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The victim must open an attacker-supplied malicious InCopy document (UI:R in the CVSS vector), and the targeted host must be running an unpatched InCopy 21.3 / 20.5.3 or earlier installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects local attack vector with required user interaction but full CIA impact, which is characteristic of client-side document-parsing bugs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker emails a publishing-house editor a malicious InCopy assignment file disguised as a legitimate story or correction from a freelance writer; when the editor opens the file in InCopy, the out-of-bounds write is triggered during parsing and the attacker's shellcode executes with the editor's privileges, enabling credential theft, lateral movement into editorial CMS systems, or deployment of ransomware. No public exploit is identified at time of analysis, but the bug class and user-interaction-only trigger are well within reach of motivated actors who craft a working POC from the advisory. |
| Remediation | Apply the patch available per Adobe advisory APSB26-59 (https://helpx.adobe.com/security/products/incopy/apsb26-59.html) by upgrading to the fixed InCopy releases listed by the vendor - exact fixed build numbers should be taken directly from that bulletin, as they are not enumerated in the CVE record itself. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all InCopy installations; communicate to users that opening files from untrusted external sources presents immediate risk and should be deferred. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Arbitrary code execution in Adobe InCopy versions 21.3, 20.5.3 and earlier occurs when a user opens a maliciously crafte
Stack-based buffer overflow in Adobe InCopy 21.3, 20.5.3 and earlier enables arbitrary code execution in the context of
Share
External POC / Exploit Code
Leaving vuln.today