CVE-2026-34701: InDesign Desktop | Heap-based Buffer Overflow (CWE-122)

Synopsis

A heap-based buffer overflow vulnerability affects Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier. The vulnerability is reached locally and requires no authentication, but a victim must open a specially crafted malicious file. Successful exploitation gives an attacker arbitrary code execution running as the current user, enabling full control over files and processes accessible to that account. No fix has been published yet; HarborGuard tracks this advisory and will flag a patched-image rebuild the moment upstream ships a remediated version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access to a listening service is required.

• AuthenticationNot required

  No account credentials or prior authentication are needed to deliver the malicious file.

• Victim interactionRequired

  A victim must be socially engineered into opening a specially crafted malicious file for the overflow to be triggered.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental preconditions.

Blast Radius

• An attacker executes arbitrary code in the context of the logged-in user, gaining the same file-system read and write access that user holds.
• Confidential documents, credentials, or secrets stored in files accessible to the user account are exposed to the attacker.
• The attacker can modify or delete files owned by the user, including project assets, configuration files, and cached credentials.
• All processes the user can launch are reachable, meaning the attacker can install persistence mechanisms or pivot to other local resources without further privilege escalation.