CVE-2026-27285 is a heap-based buffer overflow vulnerability (CWE-122) in Adobe InDesign Desktop versions 20.5.2, 21.2, and earlier. The flaw allows an attacker to cause an application denial-of-service by crashing or disrupting InDesign's functionality. Exploitation requires that the victim opens a crafted malicious file, involving user interaction. The vulnerability affects availability but does not compromise confidentiality or integrity. There is no vendor-provided patch or official remediation information available at this time.

Successful exploitation results in denial-of-service by crashing or disrupting Adobe InDesign Desktop. There is no indication of data confidentiality or integrity loss. The attack requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources to avoid triggering the vulnerability.