Adobe InDesign Flaw Lets Attackers Execute Code via Malicious Files

The National Vulnerability Database is flagging a critical Use After Free vulnerability impacting Adobe InDesign Desktop. Versions 20.5.2, 21.2, and earlier are susceptible to this flaw, which carries a CVSS score of 7.8, classifying it as High severity. Attackers can leverage this vulnerability, identified as CWE-416, to achieve arbitrary code execution on a victim’s system, operating within the user’s current privileges.

Exploitation of CVE-2026-27283 isn’t a walk in the park for attackers; it requires a user to interact with a malicious file. This typically means tricking a user into opening a specially crafted InDesign document. While the specific products affected are not detailed by the NVD beyond the InDesign Desktop versions, the potential for significant compromise is clear. A successful exploit could lead to a full takeover of the user’s session, allowing attackers to steal data, deploy further malware, or disrupt operations.