Use After Free Vulnerability in Adobe InDesign Desktop
CVE-2026-34696

7.8HIGH

Key Information:

Vendor

Adobe
Status
Indesign Desktop
Vendor
CVE Published:
9 June 2026

What is CVE-2026-34696?

A Use After Free vulnerability exists in Adobe InDesign Desktop versions 21.3 and 20.5.3, as well as earlier releases. This flaw can allow an attacker to execute arbitrary code on the target machine if a malicious file is opened by the user. Exploitation hinges on user interaction, making it crucial for users to exercise caution when handling files from unknown sources. This vulnerability underscores the importance of keeping software updated to mitigate potential security risks.

Affected Version(s)

InDesign Desktop 0 <= 20.5.3

References

https://helpx.adobe.com/security/products/indesign/apsb26...
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.