CVE-2024-39391 Overview
CVE-2024-39391 is an out-of-bounds write vulnerability affecting Adobe InDesign Desktop. The flaw impacts InDesign versions ID19.4, ID18.5.2, and earlier releases on both Windows and macOS. An attacker can achieve arbitrary code execution in the context of the current user by crafting a malicious InDesign file. Successful exploitation requires user interaction, as the victim must open the weaponized document. Adobe published security bulletin APSB24-56 addressing this issue and related vulnerabilities in the InDesign product line.
Critical Impact
Arbitrary code execution in the context of the current user via a malicious InDesign file, enabling attacker control over data and applications accessible to that user.
Affected Products
- Adobe InDesign Desktop ID19.4 and earlier
- Adobe InDesign Desktop ID18.5.2 and earlier
- Windows and macOS installations of InDesign
Discovery Timeline
- 2024-08-14 - CVE-2024-39391 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-39391
Vulnerability Analysis
The vulnerability is classified as an out-of-bounds write ([CWE-787]). During file parsing, InDesign writes data past the boundary of an allocated buffer. This memory corruption condition allows an attacker to overwrite adjacent memory structures, function pointers, or control flow data. When crafted precisely, the write primitive leads to arbitrary code execution under the privileges of the user running InDesign.
Because InDesign processes complex document formats containing embedded objects, fonts, and structured data streams, malformed length or offset fields inside a crafted file can drive the parser into unsafe write operations.
Root Cause
The root cause is missing or incorrect bounds validation on data written to a buffer during document parsing. Attacker-controlled fields in the InDesign file format influence the size or destination of a write operation. Without proper validation, the parser writes beyond the intended buffer boundary and corrupts adjacent memory.
Attack Vector
The attack vector is local and requires user interaction. An attacker delivers a malicious .indd or related InDesign file through email, file sharing, or a web download. The victim opens the file in a vulnerable InDesign version, triggering the out-of-bounds write and executing attacker-supplied code under the victim's account. No elevated privileges are needed to launch the attack, but exploitation is bounded by the current user's permissions.
No public proof-of-concept exploit is currently listed for this issue, and it is not tracked on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-39391
Indicators of Compromise
- Unexpected child processes spawned by InDesign.exe or the macOS Adobe InDesign process, particularly command shells or scripting interpreters.
- InDesign process crashes or exception events immediately after opening a document received from an external source.
- Suspicious network connections initiated by the InDesign process to unfamiliar hosts.
- Newly created executables or scripts in user-writable directories following the opening of an InDesign file.
Detection Strategies
- Monitor endpoint telemetry for anomalous process lineage originating from InDesign, using behavioral analytics rather than static signatures.
- Alert on file writes by InDesign to autorun locations, startup folders, or scheduled task directories.
- Inspect email and web gateways for .indd, .idml, and .indt attachments from untrusted senders.
Monitoring Recommendations
- Track InDesign version inventory across managed endpoints to identify hosts still running ID19.4, ID18.5.2, or earlier.
- Correlate document-open events with subsequent process, file, and network activity to surface post-exploitation behavior.
- Enable crash reporting for InDesign so repeated exceptions can be triaged as potential exploitation attempts.
How to Mitigate CVE-2024-39391
Immediate Actions Required
- Update Adobe InDesign to a version later than ID19.4 and ID18.5.2 as directed in Adobe bulletin APSB24-56.
- Restrict opening of InDesign files received from untrusted sources until patching is complete.
- Ensure standard users do not run InDesign with elevated privileges, limiting the blast radius of successful exploitation.
Patch Information
Adobe released fixed versions of InDesign addressing CVE-2024-39391. Refer to the Adobe InDesign Security Advisory APSB24-56 for the current fixed version numbers and download instructions for Windows and macOS.
Workarounds
- Block delivery of InDesign file types at email and web gateways for users who do not require them.
- Use application allowlisting to prevent InDesign from launching child processes such as cmd.exe, powershell.exe, or shell interpreters on macOS.
- Open untrusted design files only in isolated virtual machines or sandboxed environments without access to sensitive data or credentials.
# Configuration example: verify installed InDesign version on Windows
reg query "HKLM\SOFTWARE\Adobe\InDesign" /s /f "Version"
# macOS: check installed InDesign build
mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
