Memory corruption in Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier
Priority MEDIUM 51CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.
Why it matters now
EPSS 0.0632 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier | Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier | — | No fix listed | CNA |
- Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier Vendor— Affected Adobe InDesign 11.4.1 and earlier, InDesign Server 11.0.0 and earlier Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:* | up to 11.4.1 | Vulnerable | Adobe |
| cpe:2.3:a:adobe:indesign_server:*:*:*:*:*:*:*:* | up to 11.0.0 | Vulnerable | Adobe |
| cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* | all versions | Running on | Apple |
| cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* | all versions | Running on | Microsoft |
- cpe:2.3:a:adobe:indesign:*:*:*:*:*:*:*:* Versions up to 11.4.1 Vulnerable ·Adobe
- cpe:2.3:a:adobe:indesign_server:*:*:*:*:*:*:*:* Versions up to 11.0.0 Vulnerable ·Adobe
- cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions all versions Running on ·Apple
- cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-7886
- 2026-10-03 Alias added: GHSA-x8p2-fmjc-76j3
References
More Adobe Indesign vulnerabilities
- TI-2019-05027 Adobe InDesign versions 14.0.1 and below have an unsafe hyperlink processing… CVSS 3.1CRITICAL 9.8
- TI-2017-08345 Memory corruption in Adobe InDesign 12.1.0 and earlier versions CVSS 3.0CRITICAL 9.8
- TI-2021-04203 Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution CVSS 3.1HIGH 8.8
- TI-2021-04202 Adobe InDesign PCX file parsing out-of-bounds write vulnerability could lead to remote code execution CVSS 3.1HIGH 8.8
- TI-2020-07817 Out-of-bounds memory access could lead to code execution CVSS 3.1HIGH 7.8
- TI-2022-12797 Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability CVSS 3.0HIGH 7.8
Sources
- CVE-2016-7886 · CVE Program
- CVE-2016-7886 · NVD
- FIRST EPSS
- GHSA-x8p2-fmjc-76j3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences