Adobe InDesign Desktop CVE-2026-48293

Exploitation requires the victim to open a malicious InDesign-format file (such as INDD or IDML) in a vulnerable Adobe InDesign Desktop installation at version 21.3, 20.5.3 or earlier; the CVSS vector AV:L/AC:L/PR:N/UI:R confirms local attack vector with mandatory user interaction and no pre-existing authentication on the target. Limiting factors that meaningfully reduce real-world risk include the need for social-engineering delivery to a user who has InDesign installed and is willing to open the document, the absence of any network or service-side exposure, and execution being bounded to the privileges of the current user - so workstations where InDesign runs under a non-administrator account further constrain post-exploitation impact.

The CVSS 3.1 score of 7.8 reflects local attack vector (AV:L) with low complexity (AC:L), no privileges required (PR:N), but mandatory user interaction (UI:R) - meaning a user must be socially engineered into opening a malicious file, which materially reduces opportunistic mass exploitation potential despite the High impact across confidentiality, integrity and availability. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input, so real-world exploitation pressure appears low at present. However, file-parsing RCEs in widely deployed creative-suite software are historically attractive for targeted phishing against design, marketing, publishing and media organizations, so this should be prioritized for patching on workstations handling externally sourced documents even though it is not a network-exposed server flaw.

An attacker crafts a malicious InDesign document containing a malformed structure that triggers the out-of-bounds write during parsing, then delivers it via spear-phishing email to a designer or marketing employee - for example, posing as a freelance contributor submitting layout assets. When the victim double-clicks the file and InDesign opens it, the memory corruption is triggered and the attacker's shellcode executes with the user's privileges, enabling credential theft, lateral movement, or ransomware deployment. No public exploit has been identified at time of analysis.