CVE-2026-34631 is an out-of-bounds write vulnerability in Adobe InCopy affecting versions 20.5.2, 21.2, and earlier. This vulnerability allows an attacker to execute arbitrary code in the context of the current user if a victim opens a crafted malicious file. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector requires local user interaction (opening a file), and no privileges are required prior to exploitation. Adobe has not yet provided an official fix or remediation guidance for this issue.

Successful exploitation can result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. Since exploitation requires user interaction, the risk is somewhat mitigated by the need for the victim to open a malicious file. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening files from untrusted sources and consider restricting access to Adobe InCopy files from unknown origins.