CVE-2026-34629 is a heap-based buffer overflow vulnerability (CWE-122) affecting Adobe InDesign Desktop versions 20.5.2, 21.2 and earlier. Exploitation requires a victim to open a malicious file, potentially leading to arbitrary code execution in the context of the current user. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. Since exploitation requires user interaction, the risk is somewhat mitigated by user behavior. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources and consider applying any available security controls to limit the impact of potential exploitation.