CVE-2026-34700: InDesign Out-of-Bounds Write Remote Code Execution

Technical summary

CVE-2026-34700 is an out-of-bounds write vulnerability (CWE-787) in Adobe InDesign Desktop. The flaw allows memory corruption through a specially crafted file that, when processed by the application, writes data beyond allocated buffer boundaries. This memory corruption can be leveraged to overwrite critical control structures and achieve arbitrary code execution within the InDesign process context. The vulnerability exists in versions 21.3, 20.5.3 and earlier on both Windows and macOS platforms. It requires user interaction—specifically opening a malicious file—to trigger the vulnerability path.

Business impact

Compromise of InDesign workstations exposes sensitive design workflows, intellectual property embedded in documents, and potential lateral movement into broader design and creative teams. For organizations relying on InDesign for publishing, branding, or content creation, successful exploitation could lead to data theft, malware infection, business interruption, and reputational harm if clients or sensitive materials are involved. The damage scope depends on user privilege levels and network segmentation, but single-user exploitation can seed further attacks.

Affected systems

Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier running on Windows and macOS are vulnerable. Organizations should inventory InDesign installations and identify users on out-of-date versions. The vulnerability does not affect web-based or cloud versions of InDesign (such as Adobe Express) or significantly older legacy versions, though only versions explicitly below the thresholds above are guaranteed unaffected.

Exploitability

The vulnerability is exploitable but not trivial. Exploitation requires delivery and social engineering to convince a user to open a malicious file. Once a victim opens the crafted file, code execution is likely automatic. There is no evidence in public repositories that an active exploit is widely weaponized or available in attacker toolkits as of the publication date. However, the CVSS score of 7.8 (HIGH) reflects the high impact and low attack complexity once the file is opened. Attackers with access to corporate email systems or ability to distribute via file-sharing platforms have a realistic path to exploitation.

Remediation

Update Adobe InDesign Desktop to a patched version above 21.3 and 20.5.3. Adobe typically releases patches through automatic update channels; users and administrators should verify their current version and enable automatic security updates if available. Verify against Adobe's official security advisory for the exact patched build numbers. Until patched, restrict file opening from untrusted or unexpected sources and educate users on the risks of opening files from external parties.

Patch guidance

Check your current InDesign version (Help > About InDesign or similar menu). If you are at version 21.3, 20.5.3 or earlier, a patch is available. Visit Adobe's security updates page or initiate an in-application update check. Organizations with managed deployments should test patches in a non-production environment before rolling out broadly. Adobe typically maintains a security update feed; confirm the specific patched version numbers against the official Adobe advisory before deployment. Apply patches promptly given the HIGH severity and code execution risk.

Detection guidance

Monitor for InDesign processes spawning unexpected child processes or executing suspicious scripts after file operations. Endpoint detection and response (EDR) tools should flag unusual memory access patterns or code injection attempts within InDesign. Network-level detectors can identify malicious file transfers targeting InDesign users. On Windows, monitor for heap corruption or access violation exceptions in InDesign. On macOS, watch for unusual codesigning violations or unexpected process execution from the InDesign sandbox. Log file-open events and correlate with network indicators of compromise.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, arbitrary code execution impact, and dual-platform (Windows/macOS) scope. However, it is not yet a critical emergency because it requires user interaction and is not in active, widespread exploit. Organizations with InDesign-heavy workflows—particularly design firms, publishing houses, and marketing teams—should patch within 30 days. Those in high-risk environments (targeted by nation-state actors, handling sensitive IP) should expedite to 7–14 days. The lack of KEV designation and public exploit code means detection and prevention can be effective during the patch window.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects: (1) High impact on confidentiality, integrity, and availability (C:H, I:H, A:H)—arbitrary code execution compromises all three; (2) Local attack vector (AV:L) and low attack complexity (AC:L)—the file processing does not require special conditions once opened; (3) User interaction required (UI:R)—a victim must open the file, which slightly reduces the score from critical; (4) Unchanged scope (S:U)—the attacker operates in the InDesign user context. The score appropriately balances the serious code-execution threat against the prerequisite of social engineering or file delivery.

Frequently asked questions