Adobe InCopy Zero-Day: Out-of-Bounds Read Poses High Risk

The National Vulnerability Database (NVD) recently detailed a critical out-of-bounds read vulnerability, CVE-2026-27287, affecting Adobe InCopy versions 20.5.2, 21.2, and earlier. This flaw, rated with a CVSS score of 7.8 (High), occurs when the application attempts to parse a specially crafted file, leading to a read operation beyond the allocated memory structure. The implications are severe: an attacker could potentially leverage this to execute arbitrary code within the context of the current user.

While this isn’t a drive-by scenario, the attack vector still hinges on user interaction. A victim must open a malicious file for the exploit to trigger. This user interaction requirement, coupled with the local attack vector (AV:L), contributes to the overall CVSS score. However, the potential for high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) means this isn’t something to brush off. It’s a classic case of CWE-125, an out-of-bounds read, which often serves as a stepping stone for more complex exploitation techniques.