CVE-2021-21099: 
Adobe InDesign vulnerability analysis and mitigation

Adobe InDesign version 16.0 (and earlier) is affected by an Out-of-bounds Write vulnerability when parsing a crafted file. The vulnerability was discovered by Francis Provencher working with Trend Micro Zero Day Initiative and was assigned CVE-2021-21099. This vulnerability affects Adobe InDesign installations on both Windows and macOS operating systems (NVD, Adobe Advisory).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) issue that occurs specifically during the parsing of PCX files. The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges but does need user interaction (NVD, ZDI Advisory).

A successful exploitation of this vulnerability could allow an unauthenticated attacker to achieve remote code execution in the context of the current user. The vulnerability could potentially lead to complete compromise of confidentiality, integrity, and availability of the affected system (NVD, ZDI Advisory).

The vulnerability requires user interaction to be exploited, specifically requiring a victim to open a malicious file. The issue stems from the lack of proper validation of user-supplied data during PCX file parsing, which can result in a write past the end of an allocated structure (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe InDesign through official channels. The vulnerability was officially addressed in Adobe's security bulletin APSB21-22 (Adobe Advisory).