A heap-based buffer overflow in Adobe InDesign Desktop allows for arbitrary code execution, posing a significant risk to user systems.

This is a heap-based buffer overflow (CWE-122) triggered when a user opens a specially crafted malicious file. The vulnerability requires user interaction and executes code in the context of the current user.

The successful exploitation of this vulnerability could lead to a full compromise of the workstation, including unauthorized data access, modification, or system disruption. With a CVSS score of 7.8, this flaw represents a high-severity risk that could be leveraged for lateral movement within a corporate network following an initial compromise.

Immediate Action: Update Adobe InDesign Desktop to version 21.3 or 20.5.3 or later to apply the necessary security patches.

Proactive Monitoring: Monitor endpoint activity for unusual spawned processes or unexpected file system modifications originating from the InDesign application.

Compensating Controls: Implement strict email filtering and endpoint protection policies to block or scan suspicious attachments before they are accessed by users.

Public Exploit Available: No (exploit_available unknown).

Given the potential for arbitrary code execution, this vulnerability should be prioritized for remediation across all managed workstations. Administrators must ensure that the latest security updates are deployed immediately to neutralize the risk of exploitation.