CVE-2026-34703: Adobe InDesign DOS Vulnerability

CVE-2026-34703 Overview

CVE-2026-34703 affects Adobe InDesign Desktop versions 21.3, 20.5.3, and earlier on both Windows and macOS. The vulnerability is a NULL pointer dereference [CWE-476] that triggers when InDesign processes a malformed document. Successful exploitation crashes the application and produces a denial-of-service condition. The attack requires local access and user interaction, since a victim must open a malicious file delivered by the attacker. No code execution, data disclosure, or integrity impact results from this flaw, which limits its operational utility to disruption scenarios.

Critical Impact
An attacker who convinces a user to open a crafted InDesign document can crash the application, interrupting design workflows and causing potential loss of unsaved work.

Affected Products

Adobe InDesign Desktop 21.3 and earlier
Adobe InDesign Desktop 20.5.3 and earlier
Microsoft Windows and Apple macOS host platforms

Discovery Timeline

2026-06-09 - CVE-2026-34703 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-34703

Vulnerability Analysis

The flaw resides in Adobe InDesign's document parsing logic, where the application dereferences a pointer without first validating that it references allocated memory. When InDesign opens a crafted file, the parser reaches a code path that assumes a structure member is initialized. The member remains NULL for the malformed input, and the subsequent memory access raises an access violation. The operating system terminates the InDesign process, producing the denial-of-service outcome described in the advisory. The attack vector is local because the malicious file must be delivered to the victim and opened within InDesign rather than processed remotely.

Root Cause

The root cause is missing validation of a pointer prior to use [CWE-476]. InDesign's file format handler does not verify that an expected object reference has been populated before dereferencing it. Adobe has not published the affected function or structure in its public advisory.

Attack Vector

An attacker crafts a malicious InDesign document and delivers it through email, shared storage, or a download link. The victim opens the document in a vulnerable version of InDesign. The parser reaches the unsafe dereference, and the process terminates. No persistence, privilege escalation, or lateral movement is possible through this vulnerability alone. Specific exploitation details are not described in prose because no verified proof-of-concept code or technical write-up has been published. Consult the Adobe InDesign Security Advisory for vendor-supplied details.

Detection Methods for CVE-2026-34703

Indicators of Compromise

Unexpected InDesign.exe or Adobe InDesign process terminations recorded in Windows Application event logs or macOS unified logs.
Crash dump artifacts referencing access violations at addresses near 0x00000000 generated by the InDesign process.
Receipt of unsolicited .indd, .indt, .idml, or related InDesign files from untrusted senders.

Detection Strategies

Monitor endpoint telemetry for repeated InDesign process crashes correlated with the opening of newly received documents.
Flag email gateway events that deliver InDesign file types from external or low-reputation domains.
Use file integrity tools to identify InDesign documents that fail structural validation prior to user access.

Monitoring Recommendations

Alert on Windows Error Reporting events with faulting module entries tied to InDesign binaries.
Track macOS ReportCrash entries that name InDesign as the responsible process.
Correlate crash events with the source path of the opened document to identify suspicious delivery channels.

How to Mitigate CVE-2026-34703

Immediate Actions Required

Apply the Adobe security update referenced in advisory APSB26-58 to all systems running InDesign Desktop.
Inventory endpoints to identify installations of InDesign 21.3, 20.5.3, and earlier releases.
Instruct users to avoid opening InDesign files received from untrusted sources until patches are deployed.

Patch Information

Adobe has released fixed versions for InDesign Desktop. Review the Adobe InDesign Security Advisory for the exact patched build numbers and download locations. Deploy the updates through Adobe Creative Cloud or enterprise software distribution channels.

Workarounds

Restrict InDesign document handling to files originating from verified internal sources until patches are applied.
Use email and web gateway controls to quarantine InDesign file attachments from external senders.
Encourage frequent saving of work-in-progress documents to limit data loss if the application crashes.

bash

# Verify installed InDesign version on macOS
mdls -name kMDItemVersion "/Applications/Adobe InDesign 2026/Adobe InDesign 2026.app"

# Verify installed InDesign version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*InDesign*" } |
  Select-Object DisplayName, DisplayVersion