CVE-2026-21357
Published: 10 February 2026
Summary
CVE-2026-21357 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 1.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the heap-based buffer overflow by requiring timely remediation through application of Adobe patches for vulnerable InDesign versions.
Implements memory safeguards such as ASLR and DEP to prevent arbitrary code execution resulting from heap buffer overflows during malicious file parsing.
Deploys malicious code protection mechanisms to scan and block malicious files before they can be opened in vulnerable InDesign instances.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in desktop client app enables arbitrary code execution via malicious file opened by user (T1204.002), directly mapping to client-side exploitation (T1203).
NVD Description
InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2026-21357 is a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop versions 21.1, 20.5.1, and earlier. The flaw, linked to CWE-122 and CWE-787, allows arbitrary code execution in the context of the current user. It received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-02-10.
Attackers can exploit this vulnerability with local access and no privileges required, but it demands user interaction, specifically opening a malicious file. Successful exploitation enables arbitrary code execution, compromising confidentiality, integrity, and availability with high impact within the user's session.
Adobe's security bulletin at https://helpx.adobe.com/security/products/indesign/apsb26-17.html provides details on the vulnerability and available patches for mitigation.
Details
- CWE(s)