InDesign Flaw Opens Door for Remote Code Execution

The National Vulnerability Database (NVD) has highlighted a critical out-of-bounds read vulnerability affecting Adobe InDesign Desktop. Versions up to 20.5.2 and 21.2 are susceptible to this flaw when processing a specially crafted file. The vulnerability, identified as CWE-125, allows an attacker to read data beyond the boundaries of an allocated memory structure.

Successful exploitation requires a user to interact with a malicious file, such as opening a booby-trapped document. Once triggered, an attacker could potentially achieve remote code execution (RCE) in the context of the current user. This means they could run arbitrary code on the victim’s machine, leading to further compromise.

With a CVSS score of 7.8 (HIGH), this vulnerability demands immediate attention from users and administrators managing InDesign environments. The attack vector is relatively straightforward, relying on social engineering to trick users into opening malicious files, a common tactic in many phishing and malware campaigns.