CVE-2026-34704: 
Adobe InDesign vulnerability analysis and mitigation

CVE-2026-34704 is a NULL Pointer Dereference vulnerability in Adobe InDesign Desktop that can result in an application-level denial-of-service. It affects InDesign Desktop versions 21.3 and earlier (in the 21.x branch) and versions 20.5.3 and earlier (in the 20.x branch) on both Windows and macOS. Adobe disclosed and patched the vulnerability on June 9, 2026, via security advisory APSB26-58. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), occurring when InDesign Desktop dereferences a pointer expected to be valid but is NULL during the processing of a specially crafted file. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a malicious file. No public proof-of-concept or detailed technical write-up has been identified at this time (Adobe Advisory, GitHub Advisory).

Successful exploitation causes the InDesign Desktop application to crash, resulting in a denial-of-service condition for the affected user. There is no impact on confidentiality or data integrity — the vulnerability is limited to availability of the application. Lateral movement or data exfiltration are not associated with this vulnerability given its local, DoS-only nature (Adobe Advisory, GitHub Advisory).

1. Craft malicious file: An attacker creates a specially crafted InDesign-compatible file (e.g., .indd or related format) designed to trigger a NULL pointer dereference during parsing.
2. Deliver the file: The attacker distributes the malicious file via phishing email, file-sharing platform, or other social engineering means targeting InDesign users.
3. User opens the file: The victim opens the malicious file in a vulnerable version of Adobe InDesign Desktop (≤21.3 or ≤20.5.3).
4. Trigger crash: InDesign attempts to dereference a NULL pointer during file processing, causing the application to crash and resulting in a denial-of-service condition for the user (Adobe Advisory, GitHub Advisory).

• File System: Presence of unexpected or unsolicited InDesign files (.indd, .idml, or similar) received via email or downloaded from untrusted sources.
• Logs: Application crash logs or Windows Event Viewer entries showing InDesign (InDesign.exe) terminating unexpectedly with an access violation or null pointer exception.
• Process: Repeated or unexpected crashes of the InDesign Desktop process shortly after opening a specific file.

Adobe has released patched versions addressing this vulnerability: InDesign Desktop 21.4 (for the 21.x branch) and 20.5.4 (for the 20.x branch) on both Windows and macOS, available via Adobe's security update APSB26-58. Users should update to these versions immediately through the Creative Cloud desktop application or Adobe's update mechanism. As a workaround, users should avoid opening InDesign files from untrusted or unknown sources, and organizations may consider endpoint controls to restrict file types processed by InDesign (Adobe Advisory).