CVE-2024-49543 Overview
CVE-2024-49543 is a stack-based buffer overflow vulnerability in Adobe InDesign Desktop. Affected versions include InDesign ID19.5, ID18.5.4, and earlier releases on both Windows and macOS. An attacker who convinces a user to open a crafted document can trigger memory corruption and execute arbitrary code in the context of the current user.
The vulnerability is tracked under [CWE-121] Stack-Based Buffer Overflow and [CWE-787] Out-of-Bounds Write. Exploitation requires user interaction because a victim must open the malicious file. Adobe published fixes in advisory APSB24-97.
Critical Impact
Successful exploitation grants arbitrary code execution under the privileges of the InDesign user, enabling malware installation, data theft, or lateral movement from the compromised workstation.
Affected Products
- Adobe InDesign Desktop ID19.5 and earlier
- Adobe InDesign Desktop ID18.5.4 and earlier
- Microsoft Windows and Apple macOS installations of the above versions
Discovery Timeline
- 2024-12-10 - CVE-2024-49543 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-49543
Vulnerability Analysis
The flaw is a stack-based buffer overflow in Adobe InDesign's file parsing logic. When InDesign processes a malformed document, it writes attacker-controlled data beyond the bounds of a fixed-size stack buffer. That overflow can overwrite saved return addresses, function pointers, or adjacent stack variables.
Overwriting these control-flow structures allows an attacker to redirect execution to attacker-supplied code. Because the process runs with the interactive user's privileges, any successful payload inherits access to that user's files, tokens, and network resources. The impact scope is confined to the local user context but includes full read, write, and execute capability within that context.
Root Cause
The root cause is insufficient bounds checking during parsing of a specific file structure inside InDesign documents. A length field or repeating element in the file drives a copy operation into a fixed stack buffer without validating that the source data fits. This maps to [CWE-121] and [CWE-787], indicating both the stack location and the out-of-bounds write behavior.
Attack Vector
The attack vector is local and requires user interaction. An attacker crafts a malicious InDesign file, typically an .indd, .indt, .idml, or related asset, and delivers it through email, chat, cloud share, or a compromised web download. When the victim opens the file in a vulnerable version of InDesign, the parser triggers the overflow. No network access to the target is needed and no authentication is required beyond the user's own session.
No public proof-of-concept is available. See the Adobe InDesign Security Advisory APSB24-97 for vendor technical details.
Detection Methods for CVE-2024-49543
Indicators of Compromise
- Unexpected crashes of InDesign.exe on Windows or Adobe InDesign on macOS, particularly access violations or stack corruption faults recorded in Windows Error Reporting or macOS crash logs.
- InDesign spawning unusual child processes such as cmd.exe, powershell.exe, wscript.exe, bash, or osascript shortly after a document is opened.
- Inbound .indd, .indt, or .idml files from untrusted senders, especially those staged in user download or temp directories.
Detection Strategies
- Alert on process-lineage anomalies where InDesign is the parent of a scripting host, shell, or LOLBin.
- Monitor for outbound network connections initiated by the InDesign process, which normally makes only a bounded set of Adobe service calls.
- Correlate InDesign crash telemetry with subsequent file writes, persistence entries, or credential access events on the same host.
Monitoring Recommendations
- Ingest EDR process, file, and network telemetry from all endpoints running Adobe Creative Cloud into a central analytics platform.
- Track InDesign version inventory to identify hosts still running ID19.5 or ID18.5.4 and earlier.
- Log document-open events for InDesign file types on endpoints and validate sender reputation for files received by email or download.
How to Mitigate CVE-2024-49543
Immediate Actions Required
- Update Adobe InDesign to the fixed versions listed in Adobe advisory APSB24-97 on all Windows and macOS endpoints.
- Instruct users not to open InDesign documents received from untrusted or unexpected sources until patching is complete.
- Verify Creative Cloud auto-update is enabled and that pending updates for InDesign are applied.
Patch Information
Adobe addressed CVE-2024-49543 in the security update described in APSB24-97. Administrators should deploy the fixed builds through Adobe Creative Cloud Desktop, the Adobe Admin Console, or their standard software distribution tooling. Confirm remediation by checking the installed InDesign version against the fixed release listed in the advisory.
Workarounds
- Restrict opening of InDesign document types to files originating from trusted internal repositories.
- Apply application allowlisting or attack surface reduction rules that block InDesign from spawning shell and scripting interpreters.
- Run InDesign under standard user accounts, never local administrator, to limit the blast radius of successful exploitation.
# Query installed InDesign version on macOS endpoints
mdls -name kMDItemVersion "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app"
# Query installed InDesign version on Windows via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
Select-Object DisplayName, DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
