CVE-2026-84396 Overview
CVE-2026-84396 is a NULL Pointer Dereference vulnerability [CWE-476] in Adobe InDesign Desktop. Exploitation causes the application to crash, resulting in a denial-of-service condition. The flaw requires local access and user interaction: a victim must open a crafted malicious file for the crash to occur.
Adobe published the fix in security bulletin APSB26-145. The vulnerability does not allow code execution or data disclosure. Impact is limited to application availability on the affected workstation.
Critical Impact
Opening a malicious InDesign document crashes the desktop application, disrupting design workflows and potentially causing loss of unsaved work.
Affected Products
- Adobe InDesign Desktop (see Adobe advisory APSB26-145 for affected versions)
Discovery Timeline
- 2026-09-22 - CVE-2026-84396 published to the National Vulnerability Database (NVD)
- 2026-09-22 - Last updated in NVD database
Technical Details for CVE-2026-84396
Vulnerability Analysis
The vulnerability is a NULL Pointer Dereference [CWE-476] in Adobe InDesign Desktop. The application dereferences a pointer that is expected to be valid but is actually NULL, triggering an access violation that terminates the process.
The issue is triggered when InDesign parses a specially crafted document. Because the attack vector is local and requires user interaction, exploitation depends on delivering a malicious .indd or related file to a user and convincing them to open it. Successful exploitation results in application termination, not code execution or memory corruption beyond the crash.
Root Cause
The application fails to validate a pointer returned from an internal function before dereferencing it while processing structured elements inside an InDesign document. When the parser encounters malformed input that causes the upstream allocation or lookup to return NULL, the subsequent read or write against that pointer aborts the process.
Attack Vector
An attacker crafts a malicious InDesign file and delivers it through email, file share, or web download. The victim opens the file in InDesign Desktop, and the parser dereferences the invalid pointer. The application crashes, causing loss of unsaved work and interruption of design workflows. No network access or elevated privileges are required. Confidentiality and integrity are not impacted; only availability of the local application is affected.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-84396
Indicators of Compromise
- Unexpected InDesign.exe process termination correlated with a recent document open event
- Windows Application event log entries showing an access violation (exception code 0xC0000005) in the InDesign process
- Creation of crash dump files in the InDesign crash reporter directory shortly after a user opens an untrusted file
Detection Strategies
- Monitor endpoint telemetry for repeated crashes of InDesign.exe across multiple users, which may indicate a malicious file circulating internally
- Inspect email and file-sharing gateways for .indd, .idml, or related InDesign file attachments from untrusted senders
- Correlate document-open events with subsequent process termination to identify suspicious files
Monitoring Recommendations
- Enable Windows Error Reporting and centralize crash telemetry for Adobe Creative Cloud applications
- Track InDesign version inventory across endpoints to identify hosts still running vulnerable builds
- Alert on unusual InDesign file downloads from external sources or unknown web origins
How to Mitigate CVE-2026-84396
Immediate Actions Required
- Apply the security update referenced in Adobe Security Bulletin APSB26-145 to all InDesign Desktop installations
- Instruct users to avoid opening InDesign documents received from untrusted or unverified sources
- Verify that Adobe Creative Cloud auto-update is enabled to receive future patches
Patch Information
Adobe released a fix for this vulnerability as part of security bulletin APSB26-145. Administrators should update InDesign Desktop to the patched version listed in the advisory. Refer to the Adobe Security Update APSB26-145 for the specific fixed versions and download instructions.
Workarounds
- Block or quarantine unsolicited InDesign file attachments (.indd, .idml) at email and web gateways until patching is complete
- Open untrusted InDesign files only in an isolated virtual machine or sandboxed environment
- Enable application auto-recovery in InDesign so unsaved work can be restored after an unexpected crash
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
