CVE-2026-34706: InCopy | Out-of-bounds Write (CWE-787)

Synopsis

Out-of-bounds write vulnerability in Adobe InCopy (versions 21.3, 20.5.3 and earlier) allows an attacker to write data beyond the bounds of an allocated memory buffer. The vulnerability is reached locally and requires no authentication, but does require a victim to open a specially crafted malicious file. Successful exploitation gives the attacker arbitrary code execution running as the current user. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is required to trigger the vulnerability.

• AuthenticationNot required

  No account or credential is needed to deliver the malicious file; the attacker does not need to authenticate to the affected system.

• Victim interactionRequired

  A victim must be social-engineered into opening a malicious InCopy file, making user interaction a required step for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other environmental factors.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker full control over any process or file that user can access.
• Reads files, credentials, and session data accessible to the current user account.
• Modifies or deletes files and application data within the current user's permissions.
• Crashes or destabilizes the InCopy application process, disrupting the user's workflow.