{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/indesign/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-27238"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InDesign"],"_cs_severities":["high"],"_cs_tags":["CVE-2026-27238","heap-based buffer overflow","adobe indesign","code execution"],"_cs_type":"advisory","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2026-27238 describes a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. The vulnerability could allow an attacker to execute arbitrary code within the security context of the currently logged-in user. Successful exploitation of this vulnerability requires a user to open a specially crafted, malicious InDesign file. This vulnerability was reported on April 14, 2026, and the primary concern for defenders lies in preventing users from interacting with potentially malicious InDesign files delivered via phishing or other means. Defenders should ensure users are educated about the risks of opening untrusted files and that InDesign installations are up to date.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eDelivery:\u003c/strong\u003e The attacker crafts a malicious InDesign file designed to trigger the heap-based buffer overflow. The file is delivered to the victim via email, shared network drive, or other file-sharing mechanisms.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser Interaction:\u003c/strong\u003e The victim, unaware of the file's malicious nature, opens the crafted InDesign file using a vulnerable version of Adobe InDesign.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation:\u003c/strong\u003e Upon opening the malicious file, the heap-based buffer overflow is triggered due to the way InDesign parses the file's data structures.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCode Execution:\u003c/strong\u003e The buffer overflow allows the attacker to overwrite parts of InDesign's memory, injecting and executing arbitrary code.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Context:\u003c/strong\u003e The injected code executes within the context of the current user account, inheriting its privileges and access rights.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence/Lateral Movement (Optional):\u003c/strong\u003e Depending on the attacker's objectives, they may attempt to establish persistence on the system (e.g., via registry keys or scheduled tasks) or use the compromised system as a pivot point for lateral movement within the network.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eObjective Achieved:\u003c/strong\u003e The attacker achieves their objective, which may include data theft, installation of malware, or further compromise of the system or network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-27238 can lead to arbitrary code execution on the victim's machine.  The impact includes potential data loss, system compromise, and further propagation of malware within an organization. Given the widespread use of Adobe InDesign in creative and publishing industries, a successful campaign could affect a significant number of users and organizations.  The severity is compounded by the ease with which malicious files can be disseminated.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEducate users about the dangers of opening unsolicited or untrusted files, particularly those with the \u003ccode\u003e.indd\u003c/code\u003e extension associated with Adobe InDesign.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Suspicious InDesign Child Processes\u003c/code\u003e to identify potentially malicious processes spawned by InDesign.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for unusual child processes of InDesign, as highlighted in the Sigma rule \u003ccode\u003eDetect Suspicious InDesign Child Processes\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eUpdate Adobe InDesign to the latest version to patch CVE-2026-27238 and other security vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-23T12:00:00Z","date_published":"2024-01-23T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-23-adobe-indesign-heap-overflow/","summary":"Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier are vulnerable to a heap-based buffer overflow, potentially leading to arbitrary code execution if a user opens a malicious file.","title":"Adobe InDesign Heap-Based Buffer Overflow Vulnerability (CVE-2026-27238)","url":"https://feed.craftedsignal.io/briefs/2024-01-23-adobe-indesign-heap-overflow/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-27283"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InDesign"],"_cs_severities":["high"],"_cs_tags":["cve-2026-27283","adobe","indesign","use-after-free","execution"],"_cs_type":"advisory","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2026-27283 is a use-after-free vulnerability affecting Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. This vulnerability can be exploited when a user opens a malicious InDesign file. Successful exploitation could lead to arbitrary code execution within the context of the current user. The vulnerability was reported to Adobe and assigned a CVSS v3.1 base score of 7.8, indicating a high severity. This vulnerability requires user interaction. The report highlights that a victim must open a malicious file for the exploitation to occur. Organizations utilizing vulnerable versions of InDesign should take appropriate actions to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker crafts a malicious Adobe InDesign file designed to trigger the use-after-free vulnerability.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers the malicious InDesign file to the victim via email or other file-sharing methods.\u003c/li\u003e\n\u003cli\u003eThe victim, unaware of the malicious nature, opens the crafted InDesign file using a vulnerable version of Adobe InDesign Desktop (20.5.2, 21.2, or earlier).\u003c/li\u003e\n\u003cli\u003eInDesign attempts to access a memory location that has already been freed, triggering the use-after-free condition.\u003c/li\u003e\n\u003cli\u003eThe attacker gains control of the program counter due to the memory corruption.\u003c/li\u003e\n\u003cli\u003eThe attacker injects and executes arbitrary code within the context of the InDesign process.\u003c/li\u003e\n\u003cli\u003eThe attacker escalates privileges or performs malicious actions such as installing malware, stealing data, or compromising the system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-27283 allows for arbitrary code execution within the context of the user running Adobe InDesign. This could allow an attacker to install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability affects Adobe InDesign Desktop users, potentially impacting creative professionals and organizations that rely on InDesign for their workflows. The vulnerability requires user interaction to trigger.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect InDesign Suspicious File Opens\u0026quot; to identify potential attempts to exploit CVE-2026-27283 by monitoring process creation events related to InDesign opening files (see rules).\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of opening files from untrusted sources and the importance of verifying the legitimacy of InDesign files before opening them.\u003c/li\u003e\n\u003cli\u003eMonitor file creation events for InDesign processes creating suspicious files (see rules).\u003c/li\u003e\n\u003cli\u003eRefer to Adobe's security bulletin APSB26-32 for official guidance and updates regarding CVE-2026-27283 (references).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-03-adobe-indesign-uaf/","summary":"Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier are susceptible to a use-after-free vulnerability (CVE-2026-27283), potentially leading to arbitrary code execution if a user opens a specially crafted file.","title":"Adobe InDesign Use-After-Free Vulnerability (CVE-2026-27283)","url":"https://feed.craftedsignal.io/briefs/2024-01-03-adobe-indesign-uaf/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.8,"id":"CVE-2026-27291"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["InDesign"],"_cs_severities":["high"],"_cs_tags":["cve-2026-27291","adobe-indesign","out-of-bounds-write","code-execution"],"_cs_type":"advisory","_cs_vendors":["Adobe"],"content_html":"\u003cp\u003eCVE-2026-27291 affects Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. This out-of-bounds write vulnerability can be exploited if a user opens a specially crafted, malicious file. Successful exploitation allows an attacker to execute arbitrary code within the security context of the current user. The attacker needs to convince the user to open the malicious file, indicating a social engineering aspect to the attack. This vulnerability poses a significant risk to organizations that rely on Adobe InDesign for creative work, as it could lead to system compromise and data breaches if exploited.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker crafts a malicious Adobe InDesign file.\u003c/li\u003e\n\u003cli\u003eThe attacker delivers the malicious file to a target user, possibly via email or other file-sharing methods.\u003c/li\u003e\n\u003cli\u003eThe user, unaware of the file's malicious nature, opens it in a vulnerable version of Adobe InDesign (20.5.2, 21.2 or earlier).\u003c/li\u003e\n\u003cli\u003eInDesign attempts to process the file, triggering the out-of-bounds write vulnerability.\u003c/li\u003e\n\u003cli\u003eThe out-of-bounds write leads to memory corruption.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the memory corruption to inject and execute arbitrary code.\u003c/li\u003e\n\u003cli\u003eThe attacker gains control of the InDesign process, inheriting the user's privileges.\u003c/li\u003e\n\u003cli\u003eThe attacker can now perform malicious actions, such as installing malware, stealing data, or moving laterally within the network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-27291 can lead to arbitrary code execution on the targeted system, effectively allowing an attacker to take control of the application and potentially the entire machine. This could result in data theft, malware installation, or further network compromise. The vulnerability impacts all users of affected Adobe InDesign versions. While the number of affected users is not specified, the potential impact is widespread among creative professionals and organizations that rely on InDesign.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Adobe InDesign to a version beyond 21.2 to patch CVE-2026-27291 as indicated in Adobe's security advisory (\u003ca href=\"https://helpx.adobe.com/security/products/indesign/apsb26-32.html\"\u003ehttps://helpx.adobe.com/security/products/indesign/apsb26-32.html\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to detect suspicious process creation events following the launch of InDesign to identify potential exploitation attempts.\u003c/li\u003e\n\u003cli\u003eEducate users about the risks of opening files from untrusted sources to mitigate the initial access vector.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-02T10:00:00Z","date_published":"2024-01-02T10:00:00Z","id":"https://feed.craftedsignal.io/briefs/2024-01-adobe-indesign-oob-write/","summary":"Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier are vulnerable to an out-of-bounds write (CVE-2026-27291), potentially allowing arbitrary code execution when a user opens a malicious file.","title":"Adobe InDesign Out-of-Bounds Write Vulnerability (CVE-2026-27291)","url":"https://feed.craftedsignal.io/briefs/2024-01-adobe-indesign-oob-write/"}],"language":"en","title":"CraftedSignal Threat Feed - InDesign","version":"https://jsonfeed.org/version/1.1"}