CVE-2024-49545: Adobe InDesign Buffer Overflow Vulnerability

CVE-2024-49545 Overview

CVE-2024-49545 is a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop versions ID19.5, ID18.5.4, and earlier. An attacker can achieve arbitrary code execution in the context of the current user by tricking a victim into opening a crafted InDesign file. The flaw is categorized under CWE-122 (Heap-based Buffer Overflow) and CWE-787 (Out-of-bounds Write). Exploitation requires user interaction, which limits automated mass exploitation but retains value in targeted phishing and supply-chain scenarios against creative and publishing workflows.

Critical Impact
Successful exploitation grants arbitrary code execution as the current user, enabling persistence, credential theft, and lateral movement from a single opened document.

Affected Products

Adobe InDesign Desktop ID19.5 and earlier
Adobe InDesign Desktop ID18.5.4 and earlier
Adobe InDesign on Apple macOS and Microsoft Windows platforms

Discovery Timeline

2024-12-10 - CVE-2024-49545 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49545

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow triggered during the parsing of a malicious InDesign document. When InDesign processes attacker-controlled structures within the file, it writes data beyond the bounds of a heap-allocated buffer. This out-of-bounds write can corrupt adjacent heap metadata, object pointers, or virtual function tables. An attacker who controls the overflowed content can pivot memory corruption into arbitrary code execution within the InDesign process. Because InDesign runs with the privileges of the interactive user, the attacker inherits those rights, including file system access, network access, and persistence primitives.

Root Cause

The root cause is insufficient bounds checking during the deserialization of structured data inside a crafted InDesign document. A size field or length calculation trusted from the file is used to drive a heap write without validation against the destination buffer size. Adobe has not published implementation-level details of the vulnerable code path.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a weaponized .indd or related InDesign file through email, chat, cloud storage, or a compromised shared project folder. When the victim opens the file in a vulnerable version of InDesign, the parser triggers the overflow and executes attacker-supplied code. See the Adobe InDesign Security Advisory APSB24-97 for authoritative vendor details.

Detection Methods for CVE-2024-49545

Indicators of Compromise

InDesign processes (InDesign.exe on Windows, Adobe InDesign on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters.
Unexpected outbound network connections initiated by the InDesign process shortly after a document is opened.
InDesign writing executable files, scripts, or scheduled task artifacts to user-writable locations.
Crash reports referencing heap corruption in InDesign following the opening of an externally sourced document.

Detection Strategies

Monitor endpoint telemetry for InDesign process ancestry anomalies, focusing on document-open events followed by process creation.
Alert on module loads or memory allocations inside InDesign that deviate from baseline behavior, including RWX allocations.
Correlate email or file-sharing delivery of .indd, .indt, and related files with subsequent suspicious behavior on the same host.

Monitoring Recommendations

Track InDesign version inventory across endpoints and flag hosts running ID19.5, ID18.5.4, or earlier.
Log and retain document-open events for creative applications on hosts handling sensitive intellectual property.
Feed process, file, and network telemetry into a central data lake to enable retrospective hunting once new indicators emerge.

How to Mitigate CVE-2024-49545

Immediate Actions Required

Apply the updates listed in Adobe Security Bulletin APSB24-97 to all InDesign installations.
Identify and prioritize systems where InDesign is used to open files received from external parties.
Instruct users to avoid opening InDesign documents from untrusted sources until patching is complete.

Patch Information

Adobe released fixed versions of InDesign that address CVE-2024-49545. Administrators should upgrade beyond ID19.5 and ID18.5.4 per the vendor guidance in the APSB24-97 advisory. Deploy patches through Adobe Creative Cloud enterprise deployment tooling or managed software distribution.

Workarounds

Restrict opening of InDesign files to those originating from trusted internal repositories until patching is complete.
Run InDesign under standard user accounts, never with local administrator privileges, to constrain post-exploitation impact.
Use email and web gateways to inspect or quarantine InDesign file attachments from external senders.
Enable operating system exploit mitigations such as ASLR, DEP, and Control Flow Guard on Windows endpoints running InDesign.

bash

# Example: enumerate installed InDesign versions on Windows endpoints
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'Adobe InDesign*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation