CVE-2026-34631
Published: 14 April 2026
Summary
CVE-2026-34631 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Adobe Incopy. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-34631 is an out-of-bounds write vulnerability (CWE-787) affecting Adobe InCopy versions 20.5.2, 21.2, and earlier. The flaw resides in the software and can result in arbitrary code execution in the context of the current user.
Exploitation requires user interaction, as a victim must open a malicious file. An attacker with local access (AV:L) and no privileges (PR:N) can deliver the file, tricking the user into opening it with low attack complexity (AC:L). Successful exploitation grants arbitrary code execution with the current user's privileges, yielding high impacts on confidentiality, integrity, and availability (CVSS v3.1 score: 7.8; AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
Adobe Security Bulletin APSB26-33 provides details on the vulnerability and mitigation at https://helpx.adobe.com/security/products/incopy/apsb26-33.html. The bulletin was referenced in the CVE published on 2026-04-14.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22720
Vulnerability details
InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open…
more
a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in Adobe InCopy enables arbitrary code execution when user opens malicious file (T1204.002 Malicious File); directly maps to client application exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds write vulnerability in Adobe InCopy by requiring timely identification, reporting, and application of patches from Adobe Security Bulletin APSB26-33.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention to minimize the impact of out-of-bounds write exploits leading to arbitrary code execution.
Deploys malicious code protection tools to scan and block malicious files that exploit the vulnerability when opened by users in InCopy.