CVE-2026-84396: 
Adobe InDesign vulnerability analysis and mitigation

CVE-2026-84396 is a NULL Pointer Dereference vulnerability (CWE-476) in Adobe InDesign Desktop that can cause an application-level denial-of-service. Disclosed on September 22, 2026, it affects InDesign Desktop versions ID21.5 and earlier, and ID20.5.4 and earlier, on both Windows and macOS. Exploitation requires a victim to open a specially crafted malicious file. It carries a CVSS v3.1 base score of 5.5 (Medium) (Adobe Advisory, GitHub Advisory).

The vulnerability is classified as CWE-476 (NULL Pointer Dereference), where InDesign Desktop dereferences a pointer expected to be valid but is NULL when processing a maliciously crafted file. The attack vector is local, requiring low attack complexity and no privileges, but mandating user interaction — specifically, the victim must open the malicious file. No public technical write-ups or proof-of-concept code detailing the precise code path or file format trigger have been identified at this time (Adobe Advisory, GitHub Advisory).

Successful exploitation results solely in an application-level denial-of-service, crashing the InDesign Desktop application on the victim's machine. There is no impact on confidentiality or data integrity, and the scope is unchanged — meaning the crash is confined to the InDesign process and does not affect other system components or enable lateral movement. The primary risk is disruption to creative workflows for users who open untrusted files (Adobe Advisory, GitHub Advisory).

There is no evidence of active in-the-wild exploitation, no public proof-of-concept code, and no threat actor attribution associated with this vulnerability. The NVD SSVC assessment confirms exploitation is "none" and the attack is not automatable. The EPSS score is approximately 0.139% (3rd percentile), indicating a very low probability of exploitation in the near term. This CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Adobe Advisory, GitHub Advisory).

1. Craft malicious file: An attacker creates a specially crafted InDesign-compatible file (e.g., .indd or related format) designed to trigger a NULL pointer dereference during parsing.
2. Deliver the file: The attacker distributes the malicious file to a target via email attachment, file-sharing platform, or social engineering, relying on the victim to open it.
3. Victim opens the file: The victim opens the malicious file in a vulnerable version of Adobe InDesign Desktop (ID21.5 or earlier, or ID20.5.4 or earlier).
4. Trigger crash: InDesign attempts to process the file and dereferences a NULL pointer, causing an unhandled exception that crashes the application, resulting in a denial-of-service condition (Adobe Advisory).

• File System: Presence of unexpected or unsolicited .indd or other InDesign-format files received from unknown or untrusted sources.
• Logs: Application crash logs or Windows Event Viewer entries (Event ID 1000/1001) referencing InDesign.exe with a faulting module indicating a null dereference; macOS crash reports in ~/Library/Logs/DiagnosticReports/ for InDesign.
• Process: Repeated unexpected termination of the InDesign Desktop process shortly after opening a specific file.

Adobe released patched versions on September 22, 2026 as part of security bulletin APSB26-145: users should update InDesign Desktop to version 21.6 or later (for the ID21.x branch) or version 20.5.5 or later (for the ID20.x branch). As an interim workaround, users should avoid opening InDesign files from untrusted or unknown sources until the patch is applied. Updates are available through the Adobe Creative Cloud desktop application or Adobe's official download portal (Adobe Advisory).

The CIS issued an advisory noting multiple vulnerabilities in Adobe products that could allow for arbitrary code execution, grouping this CVE with the broader September 2026 Adobe patch cycle. Coverage was otherwise limited to automated vulnerability tracking services (Tenable, AUSCERT, VulDB) with no notable independent researcher commentary or significant social media discussion, consistent with the vulnerability's moderate severity and limited exploitation potential (CIS Advisory).