CVE-2026-21276: high-severity vulnerability in Adobe InDesign Desktop
InDesign Desktop | Access of Uninitialized Pointer (CWE-824)
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.8epss 0.3%
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Adobe · InDesign DesktopRelated CVEs — Adobe InDesign Desktop
In the same product, most dangerous first.
CVE-2024-49507HIGHInDesign Desktop | Heap-based Buffer Overflow (CWE-122)EPSS 0.5%CVE-2024-49508HIGHInDesign Desktop | Heap-based Buffer Overflow (CWE-122)EPSS 0.5%CVE-2024-49509HIGHInDesign Desktop | Heap-based Buffer Overflow (CWE-122)EPSS 0.5%CVE-2022-28832HIGHAdobe InDesign Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityEPSS 0.4%CVE-2024-49545HIGHInDesign Desktop | Heap-based Buffer Overflow (CWE-122)EPSS 0.4%CVE-2024-49543HIGHInDesign Desktop | Stack-based Buffer Overflow (CWE-121)EPSS 0.4%