CVE-2026-34700: InDesign Desktop | Out-of-bounds Write (CWE-787)

Synopsis

Out-of-bounds write vulnerability in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code by convincing a victim to open a specially crafted file. The attack does not require network access or any authentication; it is triggered locally when the user opens a malicious document. Successful exploitation gives the attacker full code execution in the context of the logged-in user, enabling data theft, file modification, or further system compromise. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as upstream ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to the vulnerable service is required.

• AuthenticationNot required

  No account or credentials are required; any unauthenticated party who can deliver a file to the victim can trigger the vulnerability.

• Victim interactionRequired

  The victim must open a malicious file, making this a social-engineering vector where the attacker must deliver a crafted document and persuade the user to open it.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race windows, or memory-layout requirements on the attacker.

Blast Radius

• The attacker executes arbitrary code in the context of the logged-in user, gaining the same file-system and process permissions that user holds.
• Files accessible to the current user, including documents, credentials stored on disk, and application data, are readable and exfiltrable.
• The attacker can modify or delete files owned by the current user, corrupting project data or planting malicious payloads.
• The running InDesign process and any child processes it spawns are fully under attacker control, enabling persistence mechanisms or lateral movement from that user context.