Adobe InDesign Desktop is vulnerable to a use after free flaw that could allow an attacker to execute arbitrary code on a victim machine.

This is a use after free vulnerability (CWE-416) triggered when the application processes a malicious file. Exploitation requires user interaction, as the victim must be convinced to open the crafted file, at which point the attacker can execute code with the privileges of the current user.

Successful exploitation of this vulnerability permits an attacker to execute arbitrary code, which could lead to a full system compromise, data exfiltration, or the installation of persistent malware. With a CVSS score of 7.8, this vulnerability is classified as High severity, as it poses a significant risk to endpoint security and organizational data integrity.

Immediate Action: Update Adobe InDesign Desktop to version 21.3, 20.5.3, or later to apply the necessary security patches.

Proactive Monitoring: Monitor system logs for unusual process execution patterns or unexpected crashes occurring immediately after users open external files.

Compensating Controls: Implement endpoint protection solutions that scan incoming files for malicious content and enforce least privilege access to limit the impact of potential code execution.

Public Exploit Available: Unknown

Given the potential for arbitrary code execution, this vulnerability represents a high risk to the workstation environment. Security teams should prioritize the deployment of the vendor-provided patches to all affected systems immediately to eliminate the underlying flaw and prevent potential exploitation.