CVE-2020-9730: 
Adobe InDesign vulnerability analysis and mitigation

A memory corruption vulnerability (CVE-2020-9730) was discovered in Adobe InDesign 15.1.1 and earlier versions. The vulnerability was identified and reported by FortiGuard Labs researcher Kexu Wang, with Adobe releasing a security update on September 8, 2020. The vulnerability specifically affects both Windows and macOS platforms (Fortinet Blog, NVD).

The vulnerability exists in the 'DOCUMENT FRAMEWORK.RPLN' plugin of Adobe InDesign. It is caused by insecure handling of malformed INDD files that can trigger an out-of-bounds memory access due to improper bounds checking. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High), with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (NVD, Fortinet Blog).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code within the context of the current user. The critical severity rating indicates the potential for significant impact on affected systems (Fortinet Blog).

The vulnerability can be exploited through a crafted INDD file. A remote attacker may be able to trigger the vulnerability when a user opens a maliciously crafted InDesign file. Fortinet released an IPS signature named 'Adobe.InDesign.CVE-2020-9730.Memory.Corruption' to protect against potential exploits (Fortinet Blog).

Adobe released a security update to address this vulnerability. Users of affected versions are strongly encouraged to apply the patch as soon as possible. Additionally, Fortinet customers received protection through IPS signatures before the patch became available (Fortinet Blog).