CVE-2026-27283
Published: 14 April 2026
Summary
CVE-2026-27283 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 10.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly preventing exploitation of this Use After Free vulnerability through installation of Adobe InDesign patches from APSB26-32.
RA-5 mandates vulnerability scanning to identify systems running vulnerable InDesign versions 20.5.2, 21.2, or earlier.
SI-16 enforces memory protections like ASLR and DEP that hinder successful arbitrary code execution from the Use After Free flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in desktop client app (InDesign) enables arbitrary code execution when victim opens malicious file; directly matches T1203 (Exploitation for Client Execution) and T1204.002 (User Execution: Malicious File).
NVD Description
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2026-27283 is a Use After Free vulnerability (CWE-416) affecting Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. Published on 2026-04-14, this flaw could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. The CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that an attacker with local access but no privileges can exploit it with low complexity by tricking a user into opening the file, achieving high impacts to confidentiality, integrity, and availability with no change in scope.
Adobe's security bulletin APSB26-32 provides details on the vulnerability and mitigation, available at https://helpx.adobe.com/security/products/indesign/apsb26-32.html.
Details
- CWE(s)