CVE-2026-34699: InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Synopsis

Heap-based buffer overflow in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code in the context of the logged-in user. The vulnerability is reached locally and requires no authentication, but a victim must open a specially crafted malicious file for exploitation to succeed. Successful exploitation gives the attacker full code execution, reading, and write access at the privilege level of the current user. No fix version has been published yet; HarborGuard tracks the advisory and will flag a patched rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network exposure is required to trigger this vulnerability.

• AuthenticationNot required

  No credentials or account of any privilege level are required to carry out the attack.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file for the overflow to be triggered.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the crafted file; no race conditions or specific memory layout dependencies are noted.

Blast Radius

• Executes arbitrary code at the privilege level of the current user, giving the attacker a foothold on the victim machine.
• Reads any files, credentials, or secrets accessible to the logged-in user account.
• Modifies or deletes files and data within the user's access scope, including project files and local configuration.
• Crashes or destabilizes the InDesign Desktop process, disrupting any dependent publishing or production workflows.