CVE-2026-34695: InDesign Desktop | Stack-based Buffer Overflow (CWE-121)

Synopsis

Stack-based buffer overflow in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code in the context of the logged-in user. The vulnerability is local in scope, requires no prior authentication, but does require the victim to open a specially crafted malicious file. Successful exploitation gives the attacker full code execution, with access to everything the current user can read, write, or run. No upstream fix has been published yet; HarborGuard is tracking the advisory and will surface a patched-image rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationNot required

  No account or credentials are needed before triggering the overflow; the attack works against any user who opens the file.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file, such as a crafted InDesign document delivered by email or download.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• The attacker executes arbitrary code with the full privileges of the logged-in user, including access to all files, credentials, and secrets that user can reach.
• Confidential data stored or cached by the user, such as design assets, authentication tokens, and locally stored documents, is readable by the attacker.
• The attacker can write or modify files owned by the current user, including configuration files, scripts, or other artifacts that may affect downstream systems.
• The attacker can crash or destabilize the InDesign process and any dependent workflows running under the same user context.