EUVD-2026-35787
GHSA-57jj-wrx7-w966
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from Vendor (adobe) · only source for this CVE.
CVSS VectorVendor: adobe
Lifecycle Timeline
1DescriptionCVE.org
InCopy versions 21.3, 20.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Arbitrary code execution in Adobe InCopy versions 21.3, 20.5.3 and earlier occurs when a user opens a maliciously crafted document that triggers a heap-based buffer overflow (CWE-122). Successful exploitation runs attacker code in the security context of the current user, making this a credible vector for endpoint compromise via social engineering. No public exploit identified at time of analysis, and the CVE is not on the CISA KEV list.
Technical ContextAI
Adobe InCopy is a professional word-processing and copy-editing application that integrates tightly with Adobe InDesign and is widely used in editorial and publishing workflows. The underlying defect is a CWE-122 heap-based buffer overflow, which means InCopy's file parser writes past the bounds of a heap-allocated buffer when handling attacker-controlled fields in a document file, corrupting adjacent heap metadata or object pointers. On modern Windows and macOS builds this typically enables a controlled write that can be steered into arbitrary code execution via techniques such as overwriting C++ vtable pointers or function pointers reached during continued parsing or rendering. The single CPE published (cpe:2.3:a:adobe:incopy:*:*:*:*:*:*:*:*) covers all editions of the product up to and including the fixed releases.
RemediationAI
Apply the updates listed in Adobe Security Bulletin APSB26-59 (https://helpx.adobe.com/security/products/incopy/apsb26-59.html) - install the post-21.3 and post-20.5.3 fixed releases via the Adobe Creative Cloud desktop app or by deploying the updated MSI/PKG packages through your software-management tooling. Until patching completes, reduce exposure by instructing editorial users not to open InCopy (.icml, .icma, .indd-related) files received from untrusted senders, route inbound document attachments through a sandbox or detonation appliance, and consider temporarily associating these file extensions with a previewer rather than InCopy on high-risk endpoints (trade-off: breaks double-click workflows for legitimate documents). Application-allowlisting and EDR rules that flag InCopy spawning child processes such as cmd.exe, powershell.exe, or osascript provide a useful detection layer until the patch is deployed.
Adobe InCopy version 16.0 (and earlier) is affected by an path traversal vulnerability when parsing a crafted file. Rate
InCopy versions 20.0, 19.5.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Heap-based buffer overflow vulnerability in Adobe InCopy versions 20.2, 19.5.3 and earlier that allows arbitrary code ex
CVE-2025-30327 is an integer overflow vulnerability in Adobe InCopy that enables arbitrary code execution with the privi
InCopy versions 20.3, 19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in
InCopy versions 20.3, 19.5.3 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could res
InCopy versions 20.3, 19.5.3 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that co
Arbitrary code execution in Adobe InCopy versions 21.0, 19.5.5 and earlier through a heap-based buffer overflow when use
Arbitrary code execution in Adobe InCopy 21.3, 20.5.3, and earlier allows attackers to run code as the current user when
Stack-based buffer overflow in Adobe InCopy 21.3, 20.5.3 and earlier enables arbitrary code execution in the context of
Arbitrary code execution in Adobe InCopy 20.5.2, 21.2 and earlier allows unauthenticated local attackers to execute mali
Out-of-bounds read in Adobe InCopy 20.5.2, 21.2 and earlier allows arbitrary code execution when users open malicious fi
Same weakness CWE-122 – Heap-based Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today