Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier contain an out-of-bounds read vulnerability (CWE-125) triggered by parsing crafted files. This memory safety issue can lead to reading beyond allocated memory, which an attacker could leverage to execute arbitrary code in the context of the current user. Exploitation requires that the victim opens a malicious file. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Adobe as of the vulnerability disclosure date.

If exploited, this vulnerability allows an attacker to execute arbitrary code with the privileges of the user who opens the malicious file. This can lead to full compromise of the user's environment within the scope of their permissions. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction, limiting the attack vector to social engineering or targeted delivery of malicious files. There are no known active exploits in the wild currently.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution and avoid opening files from untrusted or unknown sources. No official mitigation or temporary fix has been provided by Adobe at this time.