CVE-2026-48293: InDesign Desktop | Out-of-bounds Write (CWE-787)

Synopsis

Out-of-bounds write vulnerability in Adobe InDesign Desktop (versions 21.3, 20.5.3 and earlier) allows an attacker to write data beyond the boundaries of an allocated memory buffer. The attack is local in delivery and requires no privileges, but the victim must open a specially crafted malicious file. Successful exploitation gives the attacker arbitrary code execution running under the current user's account. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment Adobe publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker does not need network access; the exploit is delivered through a malicious file opened locally on the victim's machine.

• AuthenticationNot required

  No account or credentials are required to exploit this vulnerability; the attacker only needs to get the victim to open a crafted file.

• Victim interactionRequired

  The victim must actively open a malicious file, making social engineering (phishing, drive-by download, or similar) a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• Executes arbitrary code in the context of the logged-in user, giving the attacker full control over any process the user can run.
• Reads files and data accessible to the current user account, including documents, credentials cached on disk, and session tokens.
• Modifies or deletes files within the current user's permissions, including tampering with application data or dropping persistent malware.
• Crashes or destabilizes the InDesign Desktop process and any dependent workflows, disrupting productivity or automated publishing pipelines.