CVE-2026-21278

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation requires user interaction in that a victim must open a malicious file.

InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation requires user interaction in that a victim must open a malicious file.

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. User interaction is required (opening a malicious file).

Stack-based buffer overflow vulnerability in InDesign Desktop versions 21.3, 20.5.3 and earlier. Could lead to arbitrary code execution in the context of the current user after opening a malicious file.

A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. User interaction is required (opening a malicious file).

A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.

A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.

A stack-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Use After Free vulnerability. This could allow arbitrary code execution in the context of the current user after opening a malicious file.