CVE-2026-21281
Published: 13 January 2026
Summary
CVE-2026-21281 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Incopy. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 9.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation including patching the heap-based buffer overflow vulnerability in Adobe InCopy to prevent arbitrary code execution.
SI-16 implements memory protections such as address space layout randomization and data execution prevention to block unauthorized code execution from heap buffer overflows.
SI-3 deploys malicious code protection mechanisms that can scan and block malicious files exploiting the buffer overflow before they are opened.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in desktop client app enables code exec via malicious file opened by user (T1204.002); directly matches Exploitation for Client Execution (T1203).
NVD Description
InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
Deeper analysisAI
CVE-2026-21281 is a heap-based buffer overflow vulnerability, associated with CWE-122 and CWE-787, affecting Adobe InCopy versions 21.0, 19.5.5, and earlier. Published on 2026-01-13, it enables arbitrary code execution in the context of the current user when exploited.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating low complexity for local attackers with no privileges needed but requiring user interaction. An attacker can exploit it by tricking a victim into opening a malicious file, potentially achieving high-impact confidentiality, integrity, and availability compromises through arbitrary code execution as the current user.
Adobe's security bulletin APSB26-04 details mitigation measures and is available at https://helpx.adobe.com/security/products/incopy/apsb26-04.html.
Details
- CWE(s)