EUVD-2026-84750
GHSA-6hg7-c9xm-hx32
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malformed InDesign file
-
DeliveryDeliver to victim via email/share
-
ExploitVictim opens file in InDesign
-
ExecutionNULL pointer dereference triggers
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to manually open an attacker-supplied malicious file in Adobe InDesign Desktop (UI:R); there is no remote, network, or unauthenticated automatic trigger. The attacker needs no privileges or credentials but is entirely dependent on social engineering the victim into opening the crafted document locally (AV:L). Impact is limited to a single application crash (A:H, C:N/I:N) with no code execution, data exposure, or system-level effect, and no non-default configuration is required - any InDesign install that opens the file is affected. |
| Impact | This is a genuinely low-priority issue despite its 5.5 MEDIUM CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms availability-only impact with no confidentiality or integrity loss - the sole consequence is an application crash. The AV:L (local) plus UI:R (user must open a malicious file) means there is no remote or automatable exploitation path; the attacker depends entirely on social-engineering a victim into opening a crafted document. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent (local file-parse DoS), with no conflicts between the CVSS vector and the description. The only realistic 'harm' is a nuisance crash of a desktop design tool with no code execution, memory disclosure, or persistence - this belongs in routine patch cycles, not emergency remediation. |
| Exploit ScenarioDerived | An attacker crafts a malformed InDesign document (e.g., a .indd or supported import file) that triggers a NULL pointer dereference in InDesign's file-parsing logic, then delivers it to a victim via email, shared drive, or download. When the victim opens the file in InDesign Desktop, the application dereferences a NULL pointer and crashes, causing loss of unsaved work and a denial-of-service condition. No public exploit code is identified at time of analysis, and exploitation is limited to a crash with no code execution. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a specially crafted document in Adobe InDesign Desktop crashes the application through a NULL pointer dereference, giving an attacker a local denial-of-service against a single workstation. The flaw is rated CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), meaning the attacker needs no credentials but must socially engineer the victim into opening a malicious file locally; impact is limited to an application crash with no code execution, data disclosure, or integrity loss. No public exploit code or confirmed active exploitation was identified at the time of analysis, so this is a low-priority availability issue for most environments despite the MEDIUM base score - patching is still advisable to remove the crash vector and any future path to more serious memory-corruption abuse.
RemediationAI
Apply the InDesign Desktop update documented in Adobe's APSB26-145 bulletin (https://helpx.adobe.com/security/products/indesign/apsb26-145.html) - that is the only complete fix for the NULL pointer dereference (patch available per vendor advisory; use the exact fixed build listed there rather than inferring a version). Where immediate updating is not possible, the practical compensating controls are workflow-oriented: treat inbound .indd/.idml and other InDesign-generated documents from untrusted sources as hostile, strip or quarantine those attachment types at the email gateway or file-transfer layer, and have designers open unfamiliar files only inside a sandboxed or non-privileged environment (the trade-off is added friction and possible font/plugin differences that can alter document rendering). Enabling InDesign's autosave/recovery settings reduces the productivity loss from an unexpected crash but does not prevent it, and endpoint application-crash telemetry on InDesign can be used to detect repeated exploitation attempts. Because exploitation requires the victim to actively open a malicious file (UI:R) and yields only a single-application crash (C:N/I:N/A:H), there is no need for emergency network isolation or host rebuilds; prioritize the update in scheduled maintenance and focus user awareness on not opening unsolicited design files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The defect is a NULL pointer dereference (CWE-476) in Adobe InDesign Desktop's handling of document files. When the application parses a malformed or crafted InDesign document, a pointer that the parser expects to reference a valid object or buffer remains NULL and is subsequently dereferenced, causing an access violation that tears down the process. This is a memory-safety/robustness class of bug rather than a memory corruption primitive: the CVSS vector (AV:L, AC:L, PR:N, UI:R, S:U, C:N/I:N/A:H) confirms that the full impact is a hard application crash on the local machine, with confidentiality and integrity unaffected and no scope change to the host OS. The attack surface is the document-parsing code path reached during a normal file open, so the vulnerability is reachable only through user-supplied content that the victim chooses to open. The CPE data (cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:*, listed twice for the affected builds) uses a wildcard version, indicating the vendor applies the fix across the InDesign Desktop release lines rather than to one narrowly versioned component; no network-facing service is involved, and no non-default configuration is required for exploitation.
Know when Indesign Desktop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file must be opened by a victim (AV:L, UI:R), no privileges needed (PR:N), and impact is a crash only, so C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Exploit-DB