EUVD-2026-84751
GHSA-g849-5848-cc4r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious InDesign file
-
DeliveryDeliver file to victim (email/share)
-
ExploitVictim opens file in InDesign
-
ExecutionNULL pointer dereference during parse
-
ImpactApplication crashes (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-crafted malicious file in InDesign Desktop (UI:R); there is no network-reachable attack surface (AV:L) and no automated/remote trigger. What limits exploitation: the attacker must first deliver the file and socially engineer the user into opening it, and the payload only produces a crash (A:H) - no code execution, privilege gain, or data access (C:N/I:N). Impact is a single-session denial-of-service that the user recovers from by restarting the application. |
| Impact | This is a genuinely low-priority issue despite its MEDIUM 5.5 rating. All available signals point to limited real-world risk: the CVSS vector is AV:L (local - the attacker cannot reach the victim over a network but must deliver a file that the user opens), UI:R (user must open a malicious file), S:U (no scope change), and impact is confined to A:H with C:N/I:N - meaning the only consequence is an application crash with no confidentiality or integrity loss and no code execution. CWE-476 (NULL Pointer Dereference) is by nature a crash/DoS primitive, not a memory-corruption RCE, so it aligns with the availability-only impact. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' There is no signal conflict: the local vector, required user interaction, and availability-only impact are mutually consistent. The realistic worst case is a single crashed InDesign session that the user simply restarts (losing unsaved work). This is a low-real-risk issue that happens to score MEDIUM purely from the A:H component; it should be patched in routine cycles, not as an emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious InDesign document (e.g., an .indd/.idml or associated asset) and delivers it to a victim via email, shared drive, or download. When the victim opens the file in InDesign Desktop, a NULL pointer dereference is triggered during parsing and the application crashes, losing any unsaved work. No public exploit code was provided, and the impact is limited to a denial-of-service - no code execution or data disclosure. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
Opening a specially crafted document in Adobe InDesign Desktop drives the application into a NULL pointer dereference that terminates the process, giving an attacker a low-cost denial-of-service against a single user session. The attack is local in nature (CVSS AV:L) and requires the victim to manually open the malicious file (UI:R); per the CVSS vector PR:N, no authentication is needed, but the attacker must first deliver the file and socially engineer the user into opening it. Impact is confined to availability (C:N/I:N/A:H) - the user recovers by relaunching InDesign, possibly losing unsaved work - and there is no public exploit code or confirmed active exploitation identified at time of analysis, so this remains a genuinely low-priority issue despite its MEDIUM 5.5 rating.
RemediationAI
Apply the vendor fix by updating Adobe InDesign Desktop to the corrected build specified in Adobe's security bulletin apsb26-145 (https://helpx.adobe.com/security/products/indesign/apsb26-145.html); no exact fix version number is included in the supplied data, so consult that advisory for the concrete release rather than assuming a version. Because the only exploitation path is a user opening a malicious document, the most effective compensating control is to prevent untrusted InDesign files from reaching users: block .indd/.idml and other InDesign-native attachments at the mail and web gateways and quarantine them for review - the trade-off is added friction for legitimate design-file collaboration, which can be mitigated with an approved internal file-exchange channel. Organizations should also disable or restrict file preview/thumbnail handlers and search indexers that might parse documents without an explicit user action, since those can turn a UI:R issue into a lower-friction event; the trade-off is degraded file-browsing convenience in Explorer/Finder. Where practical, run InDesign in a sandboxed, low-privilege context or virtualized session so a crash cannot affect other workloads or leave the host in an unrecoverable state, noting that sandboxing can break plug-ins and font/link resolution. Users should be trained to treat unexpected design files as untrusted and to save work frequently, since recovery from the crash is simply a restart and the primary residual damage is loss of unsaved work. There is no server-side or network-perimeter mitigation available for this defect, and vulnerability scanners keyed on the wildcarded CPE will not resolve specific builds, so inventory should rely on the installed version reported by Adobe's update mechanism.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a NULL pointer dereference (CWE-476) in Adobe InDesign Desktop's parsing of a malformed document. InDesign is a desktop publishing application that consumes complex, structured file formats containing embedded graphics, text frames, and linked assets; when a specific field or object expected by the parser is absent or malformed, the code dereferences an uninitialized or NULL pointer instead of validating it, and the process faults. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms a local attack vector with low complexity, no privileges required, and mandatory user interaction: the file must be opened by the victim inside the application, meaning there is no network-reachable or automated trigger such as a service port, browser-rendered content, or background service. Only availability is impacted within the single application instance (scope unchanged); there is no evidence of memory-corruption-based code execution, privilege escalation, or information disclosure in the provided data, and the CPE entries cpe:2.3:a:adobe:indesign_desktop are version-wildcarded, so a precise affected build range is not enumerated in the supplied intelligence other than through Adobe's own bulletin.
Know when Indesign Desktop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Local file-open vector (AV:L) needing victim interaction (UI:R), no auth (PR:N); a NULL-deref yields availability-only crash (A:H, C:N/I:N), matching vendor.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Indesign Desktop
View allArbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier stems from a use-after-free condition trigge
Arbitrary code execution in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier allows unauthenticated attackers to
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a heap-based buffer
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs when a user opens a maliciously craft
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through an out-of-bounds wri
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs via a heap-based buffer overflow (CWE
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a mal
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier occurs through a stack-based buffer overflow
Arbitrary code execution in Adobe InDesign Desktop 21.3, 20.5.3 and earlier allows attackers to run code as the logged-i
Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier occurs through a stack-based buffer
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Heap-based buffer overflow in Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier enables arbitrary code execution
Exploit-DB