CVE-2026-21275: Adobe InDesign RCE Vulnerability

CVE-2026-21275 Overview

CVE-2026-21275 affects Adobe InDesign Desktop versions 21.0, 19.5.5, and earlier on both Windows and macOS. The flaw is an Access of Uninitialized Pointer vulnerability [CWE-824] that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious InDesign file crafted by an attacker. Adobe published the fix in security advisory APSB26-02.

Critical Impact

Successful exploitation grants arbitrary code execution under the current user account, enabling document tampering, credential theft, and lateral movement from the compromised workstation.

Affected Products

• Adobe InDesign Desktop 21.0 and earlier
• Adobe InDesign Desktop 19.5.5 and earlier
• Microsoft Windows and Apple macOS hosts running the affected InDesign builds

Discovery Timeline

• 2026-01-13 - CVE-2026-21275 published to NVD
• 2026-01-13 - Adobe releases Adobe Security Advisory APSB26-02
• 2026-01-14 - Last updated in NVD database

Technical Details for CVE-2026-21275

Vulnerability Analysis

The vulnerability stems from InDesign accessing a pointer that has not been initialized to a valid memory location [CWE-824]. When the application parses a crafted document, control flow reaches code that dereferences the uninitialized pointer. The contents of that memory location depend on prior allocator state, giving attackers a path to influence the dereferenced value.

By shaping process memory through document structure, attackers can steer the uninitialized pointer toward attacker-controlled data. Subsequent reads or writes through this pointer corrupt program state and can redirect execution. The result is arbitrary code execution within the InDesign process, inheriting the privileges of the user that opened the file.

Root Cause

The defect originates in InDesign's file parsing logic where an object pointer is used before being assigned. Compiler-inserted stack values, leftover heap contents, or partially constructed objects fill the uninitialized slot. The parser proceeds as if the pointer were valid, violating the assumption that all object fields are initialized before use.

Attack Vector

This is a local, user-assisted attack. An attacker delivers a malicious .indd or related InDesign file through email, file sharing, or web download. When the victim opens the file in a vulnerable InDesign version, the parser triggers the uninitialized pointer access. No elevated privileges are required for exploitation, and execution occurs entirely within the user session.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-21275

Indicators of Compromise

• InDesign processes (InDesign.exe on Windows, Adobe InDesign on macOS) spawning command shells, powershell.exe, cmd.exe, osascript, or /bin/sh
• Unexpected child processes performing network connections shortly after an InDesign document is opened
• Crash dumps or Windows Error Reporting events referencing InDesign access violations on document load
• InDesign writing executable content to user-writable directories such as %TEMP%, %APPDATA%, or ~/Library/Application Support

Detection Strategies

• Hunt for InDesign process trees where the parent is InDesign.exe and the child is an interpreter or LOLBin
• Alert on InDesign reading documents from untrusted locations (email attachment paths, browser download folders) followed by outbound network activity
• Correlate application crash telemetry with subsequent process creation events on the same host within a short time window

Monitoring Recommendations

• Enable command-line auditing and process-creation logging on all hosts running InDesign
• Forward EDR telemetry, Windows Event ID 4688, and macOS Endpoint Security events to a central SIEM for correlation
• Track InDesign version inventory across endpoints to identify hosts still running 21.0 or 19.5.5 and earlier

How to Mitigate CVE-2026-21275

Immediate Actions Required

• Apply the Adobe InDesign updates referenced in Adobe Security Advisory APSB26-02 on all Windows and macOS endpoints
• Inventory installations and prioritize patching for users who routinely open externally sourced InDesign files
• Educate users to verify the origin of .indd, .indt, .idml, and related files before opening

Patch Information

Adobe addressed the vulnerability in the InDesign updates listed in advisory APSB26-02, published January 13, 2026. Administrators should deploy the fixed builds through Adobe Creative Cloud or enterprise update channels and confirm that versions 21.0 and 19.5.5 are no longer present.

Workarounds

• Restrict opening InDesign files received from untrusted senders or downloaded from untrusted websites
• Run InDesign under standard user accounts rather than administrative accounts to limit post-exploitation impact
• Use application allowlisting or attack-surface reduction rules to block InDesign from launching script interpreters and command shells

# Verify installed InDesign version on macOS
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe InDesign 2025/Adobe InDesign 2025.app"

# Verify installed InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*InDesign*" } |
  Select-Object DisplayName, DisplayVersion