CVE-2026-27285

InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/indesign/apsb26-32.html	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:adobe:indesign::::::::
	cpe:2.3:a:adobe:indesign::::::::

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de escritorio de InDesign 20.5.2, 21.2 y anteriores están afectadas por una vulnerabilidad de desbordamiento de búfer basado en montículo que podría conducir a una denegación de servicio de la aplicación. Un atacante podría explotar esta vulnerabilidad para bloquear la aplicación o interrumpir su funcionalidad. La explotación de este problema requiere interacción del usuario, en el sentido de que la víctima debe abrir un archivo malicioso.

Information

Published : 2026-04-14 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-27285

Mitre link : CVE-2026-27285

CVE.ORG link : CVE-2026-27285

JSON object : View

Products Affected

apple

macos

adobe

indesign

microsoft

windows

CWE

CWE-122

Heap-based Buffer Overflow

{"id": "CVE-2026-27285", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27285", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-14T19:41:02.251593Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "psirt@adobe.com", "affectedData": [{"vendor": "Adobe", "product": "InDesign Desktop", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "21.2"}, {"status": "unaffected", "version": "21.3", "versionType": "semver"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20.5.2"}, {"status": "unaffected", "version": "20.5.3", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-14T17:16:48.200", "references": [{"url": "https://helpx.adobe.com/security/products/indesign/apsb26-32.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-122"}]}], "descriptions": [{"lang": "en", "value": "InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to crash the application or disrupt its functionality. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones de escritorio de InDesign 20.5.2, 21.2 y anteriores est\u00e1n afectadas por una vulnerabilidad de desbordamiento de b\u00fafer basado en mont\u00edculo que podr\u00eda conducir a una denegaci\u00f3n de servicio de la aplicaci\u00f3n. Un atacante podr\u00eda explotar esta vulnerabilidad para bloquear la aplicaci\u00f3n o interrumpir su funcionalidad. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5644C156-EB3C-4F24-A9E8-ABB5EA61F2A9", "versionEndExcluding": "20.5.3"}, {"criteria": "cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C6F7C5A5-F818-4184-81C3-35282D05CBEA", "versionEndExcluding": "21.3", "versionStartIncluding": "21.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@adobe.com"}