CVE-2026-34697: InDesign Desktop | Stack-based Buffer Overflow (CWE-121)

Synopsis

Stack-based buffer overflow in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code on a victim's machine. The vulnerability is local in nature and requires no authentication, but the victim must open a specially crafted malicious file. Successful exploitation gives the attacker full code execution running as the current user, enabling data theft, file tampering, or further system compromise. No fix version has been published yet; HarborGuard tracks the Adobe advisory and will flag a patched-image rebuild the moment upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no remote network access to the service is required.

• AuthenticationNot required

  No account or credentials on the target system are needed to trigger the vulnerability.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file in InDesign Desktop for the overflow to be triggered.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the crafted file; no race conditions or special environmental factors are required.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker the same file-system and process permissions as that user.
• Reads any files accessible to the current user, including stored credentials, design assets, and sensitive documents.
• Modifies or deletes files on the host that the current user has write access to.
• Crashes or destabilizes the InDesign Desktop process, disrupting the user's workflow and any dependent production pipelines.