InDesign Flaw: Out-of-Bounds Write Allows Code Execution

The National Vulnerability Database (NVD) has detailed a critical vulnerability, CVE-2026-27291, impacting Adobe InDesign Desktop. Versions 20.5.2 and earlier are susceptible to an out-of-bounds write flaw. Successful exploitation could grant attackers arbitrary code execution within the user’s current context.

This exploit vector isn’t novel; it requires a user to open a specifically crafted malicious file, a common social engineering tactic. However, the potential impact is significant given InDesign’s widespread use in creative and publishing workflows. The CVSS score of 7.8 (HIGH) underscores the severity, with the vector indicating local access, low complexity, no privileges needed, user interaction required, and a complete compromise of confidentiality, integrity, and availability.

The National Vulnerability Database highlights this as a CWE-787 (Out-of-bounds Write) issue, a class of vulnerability that often leads to memory corruption and subsequent code execution. While specific affected product versions are listed, details on other potentially impacted Adobe products or specific attack chains are not yet fully elaborated.