CVE-2026-21275
Published: 13 January 2026
Summary
CVE-2026-21275 is a high-severity Access of Uninitialized Pointer (CWE-824) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-21275 is an Access of Uninitialized Pointer vulnerability (CWE-824) affecting Adobe InDesign Desktop versions 21.0, 19.5.5, and earlier. The flaw allows arbitrary code execution in the context of the current user when processing malicious files. It has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H), indicating high impact with local access required, low attack complexity, no privileges needed, and user interaction.
Exploitation requires a victim to open a specially crafted malicious file in a vulnerable InDesign instance, enabling an attacker with local access to the system to achieve arbitrary code execution as the current user. This could lead to full compromise of the user's session, including high confidentiality, integrity, and availability impacts, though it does not escalate privileges or change scope.
Adobe's security bulletin (APSB26-02) at https://helpx.adobe.com/security/products/indesign/apsb26-02.html provides details on the vulnerability and available patches for mitigation. Security practitioners should ensure affected InDesign versions are updated promptly to address this issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2054
Vulnerability details
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a…
more
victim must open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Uninitialized pointer flaw in desktop client enables arbitrary code execution upon opening a crafted malicious file (T1204.002), directly matching exploitation for client execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely identification, reporting, and patching of known flaws like CVE-2026-21275 in vulnerable Adobe InDesign versions to prevent exploitation.
Implements memory protection mechanisms such as ASLR and DEP that directly mitigate uninitialized pointer dereference vulnerabilities leading to arbitrary code execution.
Deploys endpoint malicious code protection to scan and block specially crafted malicious InDesign files prior to user interaction and opening.