CVE-2021-42731

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Adobe InDesign versions 16.4 (and earlier) are affected by a Buffer Overflow vulnerability when parsing a specially crafted file. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-120

Affected software

Vendor	Product	Versions
Adobe	InDesign	>= unspecified, <= 16.4; >= unspecified, <= None

References

https://helpx.adobe.com/security/products/indesign/apsb21-107.htmlRelease Notes, Vendor Advisory
https://helpx.adobe.com/security/products/indesign/apsb21-107.htmlRelease Notes, Vendor Advisory

Timeline

Published: Nov 16, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-427327.8Access of Memory Location After End of Buffer (CWE-788)CVE-2021-427335.5Adobe Bridge version 11.1.1 (and earlier) is affected by a Null pointer dereference vulnerability when parsing a specially crafted file. An CVE-2021-427345.5Adobe Photoshop version 22.5.1  and earlier versions   are affected by an out-of-bounds read vulnerability that could lead to disclosure of CVE-2021-427357.8Adobe Photoshop version 22.5.1 (and earlier versions ) is affected by an Access of Memory Location After End of Buffer vulnerability, potent CVE-2021-427377.8Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious WAV file, CVE-2021-427387.8Adobe Prelude version 10.1 (and earlier) is affected by a memory corruption vulnerability due to insecure handling of a malicious MXF file, CVE-2021-427396.7The firewire subsystem in the Linux kernel through 5.14.13 has a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers CVE-2021-42746.1A vulnerability, which was classified as problematic, has been found in sileht bird-lg. This issue affects some unknown processing of the fi CVE-2021-427409.8The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a r CVE-2021-427437.8A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk CVE-2021-427445.5Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized a CVE-2021-427485.3In Beaver Builder through 2.5.0.3, attackers can bypass the visibility controls protection mechanism via the REST API.