CVE-2021-21098: 
Adobe InDesign vulnerability analysis and mitigation

Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. The vulnerability was discovered by Francis Provencher working with Trend Micro Zero Day Initiative and was disclosed on May 13, 2021 (Adobe Security, ZDI Advisory).

The vulnerability is identified as CVE-2021-21098 with a CVSS score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The specific flaw exists within the parsing of PCX files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated structure (ZDI Advisory).

An attacker can leverage this vulnerability to execute arbitrary code in the context of the current process. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity (ZDI Advisory).

User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability can be exploited through PCX file parsing (ZDI Advisory).

Adobe has issued an update to correct this vulnerability. Users should apply the security update provided in the Adobe Security Bulletin (Adobe Security).