Description
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS breakdown
CVSS 3.1
Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Adobe / Adobe Experience Manager 6.56.5.25 – 6.5.25
- Adobe / Adobe Experience Manager 6.50 – 6.5.24
- Adobe / Adobe Experience Manager 6.5 LTS0 – SP2
- Adobe / Adobe Experience Manager 6.5 LTSSP3 – SP3
- Adobe / Adobe Experience Manager as a Cloud Service0 – 2026.7.0
- Adobe / Adobe Experience Manager as a Cloud Service2026.8.0 – 2026.8.0
- Adobe / InDesign20.5.3
- Adobe / InDesign Desktop21.3 – 21.3
- Adobe / InDesign Desktop20.5.3 – 20.5.3
- Adobe / InDesign Desktop0 – 20.5.2
- Adobe / InDesign Desktop0 – 21.2
References
Updated 5m ago · 8 sources