VDB
CVE-2026-21278
CVE-2026-21278
PUBLISHED
CVSS 5.5 MEDIUM
InDesign Desktop versions 21.0, 19.5.5 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to access sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
EPSS 0.04% · 11.9th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
0.04%
11.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | InDesign Desktop | 0, 0 |
| adobe | indesign | 0, 21.0, 0 |
Timeline
- Dec 12, 2025 CVE ID Reserved
- Jan 13, 2026 CVE Published
- Jan 13, 2026 CVE Updated
- Jan 14, 2026 EPSS Score
- Jan 17, 2026 EPSS Score
- Jan 20, 2026 EPSS Score
- Jan 23, 2026 EPSS Score
- Jan 26, 2026 EPSS Score
- Jan 29, 2026 EPSS Score
- Feb 1, 2026 EPSS Score
- Feb 4, 2026 EPSS Score
- Feb 7, 2026 EPSS Score