CVE-2026-34700 is an out-of-bounds write vulnerability affecting Adobe InDesign Desktop versions 21.3, 20.5.3, and earlier. This vulnerability can lead to arbitrary code execution in the context of the current user upon opening a malicious file. The attack vector requires local user interaction, and no privileges are required to exploit it. The vulnerability impacts confidentiality, integrity, and availability with high severity. No official patch or remediation level has been disclosed at this time.

Successful exploitation allows an attacker to execute arbitrary code with the current user's privileges, potentially compromising the affected system's confidentiality, integrity, and availability. The attack requires the user to open a malicious file, so social engineering or tricking the user is necessary. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources and consider restricting access to Adobe InDesign Desktop or running it in a restricted environment.