CVE-2024-39390 Overview
CVE-2024-39390 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe InDesign Desktop versions ID19.4, ID18.5.2, and earlier. The flaw allows arbitrary code execution in the context of the user running the application. Exploitation requires the victim to open a crafted InDesign file, making user interaction a required precondition. Adobe published the security advisory APSB24-56 in August 2024 to address the issue on both Windows and macOS platforms.
Critical Impact
Successful exploitation results in arbitrary code execution under the current user's privileges, enabling attackers to run malicious payloads on affected workstations.
Affected Products
- Adobe InDesign Desktop ID19.4 and earlier
- Adobe InDesign Desktop ID18.5.2 and earlier
- Windows and macOS installations of the affected InDesign versions
Discovery Timeline
- 2024-08-14 - CVE-2024-39390 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-39390
Vulnerability Analysis
The vulnerability is an out-of-bounds write in Adobe InDesign's file parsing logic. When InDesign processes a malformed document, the application writes data past the boundaries of an allocated buffer. This memory corruption can be leveraged to overwrite adjacent structures, control program flow, and execute attacker-supplied code. The issue falls under [CWE-787], a class of memory safety defects that commonly enable code execution in desktop document processors.
Because InDesign is widely deployed on design and publishing workstations, exploitation typically targets users through spearphishing attachments or files delivered via collaboration platforms. The attack vector is local, and the attacker must convince the user to open the malicious .indd or related InDesign file.
Root Cause
The root cause is insufficient bounds checking during parsing of structured data in an InDesign document. Fields controlled by the file content influence write offsets or sizes without validation against the destination buffer, allowing writes beyond allocated memory. This is a common failure mode in complex binary document parsers that handle nested and variable-length records.
Attack Vector
An attacker crafts a malicious InDesign file containing manipulated structures that trigger the out-of-bounds write during parsing. The file is delivered to a victim through email, shared storage, or a compromised website. When the victim opens the file in a vulnerable version of InDesign, the corruption occurs, and the attacker's shellcode executes with the user's privileges. No network access to the target is required, and no authentication is needed to weaponize the file.
The vulnerability affects file parsing routines in Adobe InDesign. Refer to the Adobe InDesign Security Advisory for the technical scope confirmed by the vendor.
Detection Methods for CVE-2024-39390
Indicators of Compromise
- Unexpected child processes spawned by InDesign.exe on Windows or Adobe InDesign on macOS, particularly shells, scripting engines, or rundll32.exe.
- InDesign process crashes or exception logs referencing memory access violations shortly after opening a document from an untrusted source.
- InDesign documents arriving from external senders with unusually large embedded structures or non-standard extensions renamed to .indd.
Detection Strategies
- Deploy behavioral endpoint detection rules that flag Adobe InDesign as a parent process for command interpreters, network utilities, or persistence-related binaries.
- Hunt across telemetry for InDesign writing executable files or modifying autostart locations after opening a document.
- Correlate email gateway logs with endpoint file-open events to identify InDesign files delivered externally and opened by end users.
Monitoring Recommendations
- Enable process creation and image load logging on workstations running Adobe InDesign and forward events to a central analytics platform.
- Track InDesign version inventory to identify hosts still running vulnerable builds ID19.4 or ID18.5.2 and earlier.
- Monitor outbound connections initiated by InDesign or its child processes to detect post-exploitation command-and-control activity.
How to Mitigate CVE-2024-39390
Immediate Actions Required
- Update Adobe InDesign to the fixed versions listed in Adobe Security Bulletin APSB24-56.
- Inventory all endpoints running InDesign to identify hosts still on ID19.4, ID18.5.2, or earlier and prioritize their remediation.
- Instruct users to open InDesign files only from trusted sources and to report suspicious documents to the security team.
Patch Information
Adobe released fixed builds addressing CVE-2024-39390 through the APSB24-56 advisory on August 13, 2024. Administrators should apply the updates through the Creative Cloud desktop application or enterprise deployment tooling. Full remediation details are documented in the Adobe InDesign Security Advisory.
Workarounds
- Restrict opening of InDesign files received from external or untrusted sources until patches are applied across the fleet.
- Apply application allowlisting to prevent InDesign from spawning shells or scripting interpreters as a defense-in-depth control.
- Use email and web gateway policies to inspect or block InDesign file types delivered from outside the organization.
# Example: query installed Adobe InDesign version on macOS to identify vulnerable hosts
defaults read "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app/Contents/Info.plist" CFBundleShortVersionString
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
