CVE-2026-21281
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
InCopy versions 21.0, 19.5.5 and earlier are affected by a heap-based buffer overflow that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.
Risk Assessment
An attacker could execute arbitrary code on the victim's system, potentially leading to full control. The risk is high as opening a malicious file is sufficient.
Recommendation
Update InCopy to the latest version. Avoid opening files from untrusted sources.
Other vulnerabilities in Adobe InCopy
See all- CVE-2026-34708High
Adobe InCopy versions 21.3, 20.5.3 and earlier are affected by a stack-based buffer overflow vulnerability that could allow arbitrary code execution in the context of the current user.
- CVE-2026-34631High
An out-of-bounds write vulnerability in Adobe InCopy versions 20.5.2, 21.2 and earlier. It could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction – opening a malicious file.
Original NVD description (English source)
InCopy versions 21.0, 19.5.5 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.