Cyber Posture

CVE-2026-21357

High

Published: 10 February 2026

Published
10 February 2026
Modified
11 February 2026
KEV Added
Patch
CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0001 1.4th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-21357 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly addresses the heap-based buffer overflow by requiring timely remediation through application of Adobe patches for vulnerable InDesign versions.

prevent

Implements memory safeguards such as ASLR and DEP to prevent arbitrary code execution resulting from heap buffer overflows during malicious file parsing.

preventdetect

Deploys malicious code protection mechanisms to scan and block malicious files before they can be opened in vulnerable InDesign instances.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
Why these techniques?

Heap buffer overflow in desktop client app enables arbitrary code execution via malicious file opened by user (T1204.002), directly mapping to client-side exploitation (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…

more

must open a malicious file.

Deeper analysisAI

CVE-2026-21357 is a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop versions 21.1, 20.5.1, and earlier. The flaw, linked to CWE-122 and CWE-787, allows arbitrary code execution in the context of the current user. It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-02-10.

Attackers can exploit this vulnerability with local access and no privileges required, but it demands user interaction, specifically opening a malicious file. Successful exploitation enables arbitrary code execution, compromising confidentiality, integrity, and availability with high impact within the user's session.

Adobe's security bulletin at https://helpx.adobe.com/security/products/indesign/apsb26-17.html provides details on the vulnerability and available patches for mitigation.

Details

CWE(s)

Affected Products

adobe
indesign
≤ 20.5.2 · 21.0 — 21.2

CVEs Like This One

CVE-2026-21277Same product: Adobe Indesign
CVE-2025-27171Same product: Adobe Indesign
CVE-2025-24453Same product: Adobe Indesign
CVE-2025-27177Same product: Adobe Indesign
CVE-2025-21123Same product: Adobe Indesign
CVE-2025-24452Same product: Adobe Indesign
CVE-2025-21157Same product: Adobe Indesign
CVE-2026-27238Same product: Adobe Indesign
CVE-2025-21121Same product: Adobe Indesign
CVE-2025-27178Same product: Adobe Indesign

References