CVE-2024-39396: 
Adobe InDesign vulnerability analysis and mitigation

Adobe InDesign Desktop versions ID18.5.2, ID19.3 and earlier are affected by an out-of-bounds read vulnerability that was disclosed on August 2, 2024. The vulnerability affects both macOS and Windows operating systems running Adobe InDesign (NVD CVE).

The vulnerability is classified as an out-of-bounds read (CWE-125) issue that could potentially expose sensitive memory information. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability requires local access and user interaction, but can lead to high confidentiality impact (NVD CVE).

The vulnerability could lead to disclosure of sensitive memory information and potentially allow attackers to bypass security mitigations such as Address Space Layout Randomization (ASLR). The exploitation requires user interaction, specifically opening a malicious file (NVD CVE).

Adobe has addressed this vulnerability in newer versions of InDesign. Users should update to versions newer than ID18.5.2 and ID19.3 to mitigate this security issue (Adobe Advisory).