CVE-2026-34702: InDesign Desktop | Stack-based Buffer Overflow (CWE-121)

Synopsis

Stack-based buffer overflow in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to execute arbitrary code in the context of the logged-in user. The vulnerability is reached locally and requires no authentication, but the victim must open a specially crafted malicious file. Successful exploitation gives the attacker full code execution under the victim's account, enabling data theft, file modification, or further system compromise. No fix version has been published yet; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No credentials or account privileges are needed; the attacker simply supplies a malicious file for the victim to open.

• Victim interactionRequired

  The victim must be socially engineered into opening a crafted InDesign file, making phishing or malicious document delivery the primary attack vector.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions or environmental dependencies beyond the victim opening the file.

Blast Radius

• Attacker executes arbitrary code with the same privileges as the logged-in user, gaining direct control over the affected workstation or container process.
• Confidential files accessible to the current user, including documents, credentials, and session tokens stored on disk, are readable by the attacker.
• The attacker can create, modify, or delete any files the current user owns, including persisted application data and configuration files.
• The affected process can be crashed or manipulated, disrupting the user's work environment and any dependent automated publishing pipelines.