Product:
InDesign Desktop
Summary
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or disrupt its functionality. Exploitation requires user interaction as a victim must open a malicious file.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.5 | CVE-2026-27285 |
Exploitation
To exploit this vulnerability, an attacker must craft a malicious file that, when opened by the victim using the affected version of InDesign Desktop, triggers the heap-based buffer overflow. This requires the victim to be tricked into opening the file, leading to potential application crashes or disruptions.
Affected Products
- InDesign Desktop versions 20.5.2 and earlier: Vulnerable to heap-based buffer overflow, leading to denial-of-service.
Mitigation
To mitigate this vulnerability, users should avoid opening files from untrusted sources and ensure they are using the latest version of InDesign Desktop. Regular updates and patches from Adobe should be applied to protect against known vulnerabilities.