Adobe Security Bulletin

Last updated on Jun 9, 2026

Security Update Available for Adobe InDesign | APSB26-58

Bulletin ID

Date published

Priority

APSB26-58

June 9, 2026

3

style

grid width 12

Summary

Adobe has released a security update for Adobe InDesign. This update addresses critical and important vulnerabilities that could lead to arbitrary code execution, application denial-of-service, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product

Affected version

Platform

Adobe InDesign

ID21.3 and earlier versions

Windows and macOS

Adobe InDesign

ID20.5.3 and earlier versions

Windows and macOS

style

grid width 12

Solution

Adobe categorizes these updates with the following priority rating and recommends users update their software installations via the Creative Cloud desktop app updater, or by navigating to the InDesign Help menu and clicking "Updates." For more information, please reference this help page.

Product

Updated version

Platform

Priority rating

Adobe InDesign

ID21.4

Windows and macOS

3

Adobe InDesign

ID20.5.4

Windows and macOS

3

style

grid width 12

Note

For managed environments, IT administrators can use the Creative Cloud Packager to create deployment packages. Refer to this help page for more information.

style

xl spacing, one up, grid width 8, static-links, xxl-spacing-top

Vulnerability Details

CVE-2026-34695

Vulnerability category: Stack-based Buffer Overflow (CWE-121)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34696

Vulnerability category: Use After Free (CWE-416)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34697

Vulnerability category: Stack-based Buffer Overflow (CWE-121)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34698

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34699

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34700

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34701

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2026-34702

Vulnerability category: Stack-based Buffer Overflow (CWE-121)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-48293

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-34703

Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2026-34704

Vulnerability category: NULL Pointer Dereference (CWE-476)
Vulnerability impact: Application denial-of-service
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2026-34705

Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Acknowledgments

Adobe would like to thank the following researchers for reporting these issues and for working with Adobe to help protect our customers:

Francis Provencher (prl) -- CVE-2026-34695, CVE-2026-34696, CVE-2026-34697, CVE-2026-34698, CVE-2026-34701, CVE-2026-34703, CVE-2026-34704, CVE-2026-34705
jony_juice -- CVE-2026-34699, CVE-2026-34702, CVE-2026-48293

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com

CardTitle

APSB26-58

CardDescription

Priority 3 Security update

CardImage

Created

2026-06-09