CVE-2026-34698: InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Synopsis

Heap-based buffer overflow in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code by convincing a victim to open a specially crafted file. The vulnerability is local in nature and requires no prior authentication, but does depend on a user opening a malicious document. Successful exploitation gives the attacker full code execution running as the current user, enabling complete access to that user's files, credentials, and system resources. No fix version has been published yet; HarborGuard tracks the upstream advisory and will flag patch availability as soon as Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the service is required.

• AuthenticationNot required

  No account or credentials are required to deliver the malicious file payload.

• Victim interactionRequired

  The victim must be socially engineered into opening a malicious InDesign file for the overflow to be triggered.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory-layout dependencies are required.

Blast Radius

• Attacker executes arbitrary code in the context of the logged-in user, gaining access to everything that user can access on the host.
• Reads files, stored credentials, session tokens, and any documents open or accessible under the current user profile.
• Writes or modifies files owned by the current user, including documents, configuration files, and local application data.
• Crashes InDesign Desktop or destabilizes the host process, disrupting the user's active work session.