CVE-2026-27286 is a heap-based buffer overflow vulnerability affecting Adobe InDesign Desktop up to versions 20.5.2 and 21.2. The vulnerability allows an attacker to cause memory exposure by crafting a malicious file that, when opened by a user, triggers the overflow. The vulnerability does not affect system integrity or availability but can lead to disclosure of sensitive information stored in memory. Exploitation requires user interaction (opening a malicious file). No known exploits are reported in the wild, and no official patch or remediation level has been provided by Adobe as of the published date.

Successful exploitation can lead to disclosure of sensitive information from the application's memory. There is no impact on system integrity or availability. The attack vector requires local user interaction, limiting the ease of exploitation. No known active exploitation has been reported.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening files from untrusted sources to avoid triggering the vulnerability.