CVE-2026-34707: InCopy | Heap-based Buffer Overflow (CWE-122)

Synopsis

A heap-based buffer overflow vulnerability affects Adobe InCopy versions 20.5.3 and earlier (including 21.3). The flaw is reached locally, requires no authentication, but does require a victim to open a specially crafted file, derived from the CVSS vector (AV:L, PR:N, UI:R). Successful exploitation gives an attacker arbitrary code execution in the context of the logged-in user, enabling full read, write, and control of anything that user can access. No fix version has been published yet; HarborGuard is tracking this advisory and will surface a patched-image rebuild the moment Adobe releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no over-the-network access path is required.

• AuthenticationNot required

  No account or credential is needed to exploit this vulnerability; the attacker requires only the ability to deliver a malicious file to the victim.

• Victim interactionRequired

  A victim must be socially engineered into opening a malicious file, making user interaction a necessary step for exploitation.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race requirements, or memory-layout dependencies on the attacker.

Blast Radius

• Successful exploitation executes arbitrary code as the current logged-in user, giving the attacker full control over any process that user can launch.
• The attacker reads any file, credential, or secret accessible to the victim user, including documents, stored tokens, and application data.
• The attacker writes or overwrites files within the victim user's permissions, enabling persistent implants, configuration tampering, or data destruction.
• The affected InCopy process and any dependent workflows are subject to crash or termination at the attacker's discretion.