CVE-2026-48293: InDesign Desktop | Out-of-bounds Write (CWE-787)
InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Do not open InDesign files from untrusted or unknown sources. Because exploitation requires a victim to open a malicious file, restrict receipt and opening of externally sourced InDesign files and treat them as potentially malicious; when such files must be inspected, open them only in a sandboxed or isolated virtual machine.
- Operational
Inform and train users that opening unsolicited or unverified InDesign files can lead to code execution. Require verification of senders and explicit approval before opening InDesign files from external sources.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48293?
The severity of CVE-2026-48293 is high, with a CVSS score of 7.8.
What vulnerability type is CVE-2026-48293?
CVE-2026-48293 is an out-of-bounds write vulnerability classified under CWE-787.
How can I protect myself from CVE-2026-48293?
To protect against CVE-2026-48293, avoid opening untrusted or malicious files in affected versions of Adobe InDesign.
Which versions of InDesign are affected by CVE-2026-48293?
CVE-2026-48293 affects Adobe InDesign versions 21.3, 20.5.3, and earlier.
What can happen if CVE-2026-48293 is exploited?
Exploitation of CVE-2026-48293 can lead to arbitrary code execution in the context of the current user.