CVE-2026-21332: 
Adobe InDesign vulnerability analysis and mitigation

CVE-2026-21332 is an out-of-bounds read vulnerability in Adobe InDesign Desktop that can lead to memory disclosure. It affects InDesign Desktop versions 21.1, 20.5.1, and earlier (specifically versions 21.0–21.1 and all versions prior to 20.5.2 in the 20.x branch). Adobe disclosed and patched this vulnerability on February 10, 2026. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory).

The vulnerability is classified as CWE-125 (Out-of-bounds Read), where the application reads data beyond the allocated memory buffer when processing a specially crafted file. An attacker exploits this by crafting a malicious InDesign document that, when opened by a victim, triggers the out-of-bounds read and exposes sensitive memory contents. The attack vector is local, requires no privileges, but does require user interaction — specifically, a victim must open the malicious file. No public proof-of-concept or technical write-up has been identified at this time (Adobe Advisory).

Successful exploitation results in the disclosure of sensitive information stored in the application's memory, impacting confidentiality. There is no impact to integrity or availability. The scope is limited to the affected application's memory space, and lateral movement potential is low given the local attack vector and requirement for user interaction (Adobe Advisory).

Adobe has released patched versions to address this vulnerability. Users should update to InDesign Desktop version 21.2 or later (for the 21.x branch) or 20.5.2 or later (for the 20.x branch). As an interim measure, users should avoid opening InDesign files from untrusted or unknown sources, and organizations should consider restricting InDesign usage to trusted file sources until patching is complete (Adobe Advisory).

The Center for Internet Security (CIS) published an advisory noting multiple vulnerabilities in Adobe products patched in February 2026, including this issue. No notable independent researcher commentary or significant social media discussion has been identified for this specific CVE.