CVE-2026-21332

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21332", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2025-12-12T22:01:18.195Z", "datePublished": "2026-02-10T17:59:54.466Z", "dateUpdated": "2026-08-27T22:02:44.953Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "InDesign Desktop", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "21.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "21.2", "versionType": "semver"}, {"lessThanOrEqual": "20.5.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "20.5.2", "versionType": "semver"}]}], "datePublic": "2026-02-10T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.5, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "LOCAL", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "HIGH", "modifiedIntegrityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedScope": "UNCHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "NONE", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "UNCHANGED", "temporalScore": 5.5, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:44.953Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/indesign/apsb26-17.html"}], "source": {"discovery": "EXTERNAL"}, "title": "InDesign Desktop | Out-of-bounds Read (CWE-125)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T19:01:03.255174Z", "id": "CVE-2026-21332", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:01:08.779Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21332", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T19:01:03.255174Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T19:01:06.262Z"}}], "cna": {"title": "InDesign Desktop | Out-of-bounds Read (CWE-125)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 5.5, "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.5, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "LOCAL", "confidentialityImpact": "HIGH", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "InDesign Desktop", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "21.1"}, {"status": "unaffected", "version": "21.2", "versionType": "semver"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "20.5.1"}, {"status": "unaffected", "version": "20.5.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-02-10T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/indesign/apsb26-17.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "Out-of-bounds Read (CWE-125)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-08-27T22:02:44.953Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21332", "state": "PUBLISHED", "dateUpdated": "2026-08-27T22:02:44.953Z", "dateReserved": "2025-12-12T22:01:18.195Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-02-10T17:59:54.466Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "InDesign Desktop", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "21.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "21.2", "versionType": "semver"}, {"lessThanOrEqual": "20.5.1", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "20.5.2", "versionType": "semver"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*", "matchCriteriaId": "75FF6705-31FC-4B07-BDBE-C82A6A52FD14", "versionEndExcluding": "20.5.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A1253BD-81D4-4241-832A-5A9614CCF525", "versionEndExcluding": "21.2", "versionStartIncluding": "21.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "InDesign Desktop versions 21.1, 20.5.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file."}, {"lang": "es", "value": "Las versiones de InDesign Desktop 21.1, 20.5.1 y anteriores est\u00e1n afectadas por una vulnerabilidad de lectura fuera de l\u00edmites que podr\u00eda conducir a la exposici\u00f3n de memoria. Un atacante podr\u00eda aprovechar esta vulnerabilidad para divulgar informaci\u00f3n sensible almacenada en memoria. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario en el sentido de que una v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-21332", "lastModified": "2026-08-28T00:16:57.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "psirt@adobe.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21332", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T19:01:03.255174Z", "version": "2.0.3"}}]}, "published": "2026-02-10T18:16:31.147", "references": [{"source": "psirt@adobe.com", "tags": ["Vendor Advisory"], "url": "https://helpx.adobe.com/security/products/indesign/apsb26-17.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "psirt@adobe.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,20.5.1]"}}], "product": "indesign_desktop", "vendor": "adobe"}], "analysis": {"en": {"generated_at": "2026-04-18T12:46:07.205631+00:00", "value": {"mitigation_remediation": ["Update Adobe InDesign Desktop to the latest patch that resolves the out\u2011of\u2011bounds read flaw.", "Configure InDesign to reject or quarantine unknown or downloaded document files at import time, ensuring only trusted sources are processed.", "Implement sandboxing or isolate document parsing in a low\u2011privilege environment to contain exposure if a malicious file is opened."], "summary": {"action": "Apply Patch", "impact": "Memory Disclosure"}, "threat_synthesis": {"affected_systems": "Adobe InDesign Desktop on macOS and Windows is affected. All releases up to and including version 21.1 and 20.5.1 contain the flaw, which arises when the program parses certain document files.", "description_and_impact": "An out\u2011of\u2011bounds read in Adobe InDesign Desktop allows an attacker to read data beyond the intended buffer limits, potentially exposing memory contents such as credentials, cryptographic keys, or other sensitive information and compromising data confidentiality. The vulnerability is classified as CWE\u2011125 and is specifically present in versions 21.1, 20.5.1 and earlier.", "risk_and_exploitability": "The CVSS score of 5.5 categorizes the vulnerability as moderate, while the EPSS score of less than 1% indicates a very low likelihood of exploitation and the issue is not listed in the CISA KEV catalog. Exploitation requires the victim to open a maliciously crafted file, implying a local or social\u2011engineering attack vector. A successful exploit would disclose memory content, potentially revealing user credentials or confidential document data, but it does not grant code execution or cause service disruption."}}}}, "created": "2026-02-11T21:52:09.186014+00:00", "updated": "2026-04-18T13:00:08.706856+00:00", "vendors": ["adobe", "adobe$PRODUCT$indesign_desktop"]}