Executive brief
Adobe InDesign Desktop is a widely-used professional page layout and design application. A vulnerability in how the application handles memory pointers could allow an attacker to execute arbitrary code if a user opens a specially crafted design file, potentially compromising the user's system and access to sensitive design projects and data.
Technical details
The vulnerability is an access of uninitialized pointer (CWE-824), a memory safety issue where the application attempts to dereference a pointer that has not been properly initialized. The vulnerable component is within InDesign's file parsing logic. Exploitation requires user interaction: a victim must be tricked into opening a malicious InDesign file. When a crafted file is opened, the uninitialized pointer access can lead to arbitrary code execution in the context of the user running InDesign. No evidence of active exploitation in the wild has been reported as of the advisory date.
Affected products
- Adobe InDesign Desktop 21.0, 19.5.5 and earlier
Timeline
- 2026-01-13: disclosed: CVE-2026-21275 published on NVD