CVE-2026-84396
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation requires user interaction in that a victim must open a malicious file.
Risk Assessment
Opening a malicious file can crash InDesign Desktop, interrupting user work and causing loss of unsaved data. The risk applies to workstations where users open files from untrusted sources.
Recommendation
Update InDesign Desktop to the latest patched version and instruct users not to open files from untrusted sources.
Other vulnerabilities in InDesign Desktop
See all- CVE-2026-76192Medium
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation requires user interaction in that a victim must open a malicious file.
- CVE-2026-48293High
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. User interaction is required (opening a malicious file).
- CVE-2026-34702High
Stack-based buffer overflow vulnerability in InDesign Desktop versions 21.3, 20.5.3 and earlier. Could lead to arbitrary code execution in the context of the current user after opening a malicious file.
- CVE-2026-34701High
A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.
- CVE-2026-34700High
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. User interaction is required (opening a malicious file).
- CVE-2026-34699High
A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.
- CVE-2026-34698High
A heap-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.
- CVE-2026-34697High
A stack-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.
- CVE-2026-34696High
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Use After Free vulnerability. This could allow arbitrary code execution in the context of the current user after opening a malicious file.
- CVE-2026-34695High
A stack-based buffer overflow vulnerability in InDesign Desktop allows remote code execution in the context of the current user. User interaction is required to open a malicious file.
Original NVD description (English source)
InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS