CVE-2026-27287 is an out-of-bounds read vulnerability in Adobe InCopy versions 20.5.2, 21.2, and earlier. The issue arises when the software parses a specially crafted file, causing it to read past the end of an allocated memory structure. This memory corruption can be leveraged by an attacker to execute arbitrary code in the context of the current user. Exploitation requires that the victim opens a malicious file, indicating user interaction is necessary. The vulnerability is rated with a CVSS 3.1 score of 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation has been published by Adobe as of the current information.

Successful exploitation can result in arbitrary code execution with the privileges of the user who opens the malicious file. This can compromise confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction, limiting the attack vector to scenarios where a user is tricked into opening a crafted file. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution and avoid opening files from untrusted or unknown sources. Monitor Adobe's official channels for updates regarding fixes or workarounds.