What is the CVSS score of CVE-2026-48293?

CVE-2026-48293 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign Desktop are affected by CVE-2026-48293?

A critical execution vulnerability in Adobe InDesign Desktop (CVSS 7.8) could allow attackers to commandeer user workstations through malicious design documents, putting sensitive design assets,…

How to fix or mitigate CVE-2026-48293?

24 hours: Inventory all Adobe InDesign Desktop installations (versions 21.3 and earlier); disable the application for non-critical users; alert users to avoid opening design files from external or untrusted sources. 7 days: Restrict design file access to verified internal teams only; implement email gateway scanning for .indd attachments; establish manual review process for all external design files. 30 days: Monitor Adobe security advisories for patch releases; prepare upgrade plan to patched version; conduct security awareness training on file-based attacks.

Adobe InDesign Desktop CVE-2026-48293

EUVD-2026-35774 HIGH

Out-of-bounds Write (CWE-787)

2026-06-09 adobe

GHSA-pqhm-q8q5-gvfx

Memory Corruption Buffer Overflow RCE Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:53 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-in user when a victim opens a maliciously crafted document file. The flaw is an out-of-bounds write (CWE-787) memory corruption issue requiring user interaction, and no public exploit has been identified at time of analysis.

Technical ContextAI

Adobe InDesign is a desktop publishing application that parses complex proprietary document formats (INDD, IDML) along with embedded image, font, and metadata structures. CWE-787 (Out-of-bounds Write) typically arises in such parsers when length fields or chunk boundaries within a file are trusted without validation, causing the parser to write attacker-controlled bytes past an allocated buffer, corrupting adjacent heap structures, vtables, or function pointers. The CPE cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* identifies the affected Adobe InDesign Desktop product line as the vulnerable component, and successful corruption of program state during file parsing is what enables the documented arbitrary code execution outcome.

RemediationAI

Apply the patch available per vendor advisory APSB26-58 at https://helpx.adobe.com/security/products/indesign/apsb26-58.html, updating Adobe InDesign Desktop beyond the affected 21.3 and 20.5.3 branches via the Adobe Creative Cloud desktop application; exact fixed version numbers should be taken directly from that bulletin. Until patching is completed, instruct users not to open INDD, IDML or related InDesign files received from untrusted sources or unexpected senders, route inbound design files through a sandboxed review workstation, and consider running InDesign under a standard (non-administrator) user account so that successful exploitation does not yield elevated privileges - noting the trade-off that this does not prevent user-level data theft or ransomware staging. Email and endpoint controls can additionally block or quarantine InDesign file types at the perimeter for user populations that do not legitimately receive them, at the cost of friction for design teams.