CVE-2026-21276: InDesign Desktop | Access of Uninitialized Pointer (CWE-824)
Published Jan 13, 2026
·Updated
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
5 affected components
Adobe InDesign Desktop<21.0
All of the following
Any of the following
Adobe InDesign<20.5.1
Adobe InDesign>=21.0<21.1
Any of the following
Apple macOS
Microsoft Windows
Event History
Jan 13, 2026
CVE Published
via MITRE·06:35 PM
Data Sourced
via MITRE·06:35 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:16 PM
DescriptionSeverityWeaknessAffected Software
Jan 6, 58022
Event
via FIRST·01:42 AM
Frequently Asked Questions
1
What is the severity of CVE-2026-21276?
CVE-2026-21276 has a high severity rating due to its potential for arbitrary code execution.
2
How do I fix CVE-2026-21276?
To fix CVE-2026-21276, update Adobe InDesign Desktop to version 21.0 or later.
3
What versions of InDesign Desktop are affected by CVE-2026-21276?
CVE-2026-21276 affects Adobe InDesign Desktop versions 21.0, 19.5.5, and earlier.
4
What types of systems are vulnerable to CVE-2026-21276?
Any system running the affected versions of Adobe InDesign Desktop is vulnerable to CVE-2026-21276.
5
Can CVE-2026-21276 be exploited remotely?
CVE-2026-21276 requires user interaction for exploitation, making it not a remote vulnerability.