CVE-2026-34628
Published: 14 April 2026
Summary
CVE-2026-34628 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Adobe Indesign. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely patching of the heap-based buffer overflow vulnerability in affected InDesign versions as provided by Adobe APSB26-32.
Implements memory protections such as DEP and ASLR that minimize the impact of heap-based buffer overflow exploitation leading to arbitrary code execution.
Malicious code protection mechanisms scan and block crafted malicious InDesign files delivered via email or shared documents before user interaction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow enables arbitrary code execution upon opening a crafted file (T1204.002); description explicitly notes delivery via email attachments and social engineering (T1566.001).
NVD Description
InDesign Desktop versions 20.5.2, 21.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim…
more
must open a malicious file.
Deeper analysisAI
CVE-2026-34628 is a heap-based buffer overflow vulnerability (CWE-122) affecting Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H). The issue could result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file processed by the vulnerable InDesign component. Local attackers with no privileges can leverage this by delivering a crafted file, such as through email attachments or shared documents, tricking users via social engineering. Successful exploitation enables arbitrary code execution with the current user's privileges, potentially leading to full system compromise on the affected machine.
Adobe Security Bulletin APSB26-32, available at https://helpx.adobe.com/security/products/indesign/apsb26-32.html, addresses this vulnerability and provides guidance on available patches for mitigation.
Details
- CWE(s)