CVE-2026-34708: InCopy | Stack-based Buffer Overflow (CWE-121)

Synopsis

Stack-based buffer overflow in Adobe InCopy affects versions 21.3, 20.5.3 and earlier. The vulnerability is reached locally and requires no authentication, but a victim must open a malicious file for exploitation to succeed. Successful exploitation gives an attacker arbitrary code execution in the context of the logged-in user, enabling full read, write, and control over anything that user can access. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required to trigger the overflow.

• AuthenticationNot required

  No account or credentials are needed; the attacker only needs to deliver a malicious file to the victim.

• Victim interactionRequired

  The victim must open a malicious file, making social engineering (for example, a phishing email with a crafted document attachment) a necessary part of the attack chain.

• Attack complexityDetail

  The exploit is reliable and condition-free once the victim opens the file; no race conditions or special environmental factors are required.

Blast Radius

• Executes arbitrary code in the context of the current user, giving the attacker full control over that user session.
• Reads any files, credentials, or secrets accessible to the victim user, including stored tokens and local configuration.
• Writes or modifies files owned by the victim user, enabling persistence mechanisms or data tampering.
• Crashes or destabilizes the InCopy process, disrupting the victim user's workflow.