CVE-2024-49544: Adobe InDesign RCE Vulnerability

CVE-2024-49544 Overview

CVE-2024-49544 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe InDesign Desktop versions ID19.5, ID18.5.4, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious InDesign file. Adobe published the security advisory APSB24-97 on December 10, 2024, addressing this and related InDesign issues. Exploitation requires local user interaction, limiting mass-exploitation scenarios but making the flaw viable in targeted phishing or supply-chain document attacks.

Critical Impact
An attacker who convinces a user to open a crafted .indd file can execute arbitrary code with the privileges of the current user on both Windows and macOS systems.

Affected Products

Adobe InDesign Desktop ID19.5 and earlier
Adobe InDesign Desktop ID18.5.4 and earlier
Windows and macOS installations of the affected versions

Discovery Timeline

2024-12-10 - CVE-2024-49544 published to NVD and Adobe advisory APSB24-97 released
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49544

Vulnerability Analysis

CVE-2024-49544 is an out-of-bounds write [CWE-787] in Adobe InDesign's file-parsing logic. When InDesign parses a crafted document, the application writes data past the intended bounds of an allocated buffer. This memory corruption can overwrite adjacent structures, function pointers, or heap metadata used by the process.

An attacker who controls the layout of the corrupted memory can steer execution flow and run arbitrary code inside the InDesign process. Because the write occurs during document parsing, no additional user action beyond opening the file is required. Code executes with the privileges of the user running InDesign, so the impact scales with the account's local rights.

Root Cause

The root cause is insufficient boundary validation while processing structured data inside an InDesign document. A parser accepts attacker-controlled length or index values and writes to memory using those values without confirming they fall within the allocated buffer. This is a classic input-validation failure that produces a memory-safety violation.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious .indd file through email, a shared drive, a design collaboration platform, or a compromised website. When the victim opens the file in a vulnerable InDesign version, the parser triggers the out-of-bounds write and the attacker's payload executes. Confidentiality, integrity, and availability impacts are all rated high because arbitrary code execution follows successful exploitation.

No public proof-of-concept exploit is listed in Exploit-DB, and CISA has not added this CVE to the Known Exploited Vulnerabilities catalog. Technical details of the corruption primitive are described in prose here because no verified exploit code is available. See the Adobe InDesign Security Advisory APSB24-97 for vendor-provided technical details.

Detection Methods for CVE-2024-49544

Indicators of Compromise

Unexpected child processes spawned by InDesign.exe on Windows or the InDesign application bundle on macOS, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Crashes or abnormal termination of InDesign shortly after opening a document, recorded in Windows Event Log or macOS CrashReporter logs.
Inbound .indd, .indt, or .idml files from untrusted senders that trigger InDesign auto-open flows.

Detection Strategies

Monitor endpoint telemetry for process-lineage anomalies where InDesign spawns scripting hosts, network utilities, or persistence tooling.
Alert on outbound network connections initiated by the InDesign process to non-Adobe domains.
Correlate InDesign crash events with subsequent file writes to user profile or startup directories.

Monitoring Recommendations

Log and review all file opens of InDesign documents originating from email attachments or downloads.
Track InDesign version inventory across managed endpoints to identify hosts still running vulnerable builds.
Ingest endpoint process, file, and network telemetry into a central data lake for behavioral analytics and retrospective hunting.

How to Mitigate CVE-2024-49544

Immediate Actions Required

Upgrade Adobe InDesign to the fixed builds published in Adobe advisory APSB24-97: InDesign 2024 version 19.5.1 and InDesign 2023 version 18.5.5 or later.
Restrict opening of InDesign documents received from untrusted or external sources until patches are deployed.
Enforce least-privilege user accounts so exploitation cannot immediately yield administrative rights.

Patch Information

Adobe released fixed versions of InDesign on December 10, 2024, addressing CVE-2024-49544 alongside other issues documented in APSB24-97. Administrators should deploy the updates through Adobe Creative Cloud or managed software distribution. Full details are available in the Adobe InDesign Security Advisory.

Workarounds

Block or quarantine inbound .indd, .indt, and .idml attachments at the mail gateway until endpoints are patched.
Use application allowlisting to prevent InDesign from launching child processes such as command shells or scripting hosts.
Isolate design workstations that process externally sourced files in a segmented network zone with restricted outbound access.

bash

# Example: verify installed InDesign version on macOS
defaults read "/Applications/Adobe InDesign 2024/Adobe InDesign 2024.app/Contents/Info.plist" CFBundleShortVersionString

# Example: query installed InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe InDesign*" } |
  Select-Object DisplayName, DisplayVersion