CVE-2026-27287

CVE-2026-27287 is an out-of-bounds read vulnerability affecting Adobe InCopy versions 20.5.2, 21.2, and earlier. When parsing specially crafted files, the flaw allows reading past the end of allocated memory structures, potentially enabling arbitrary code execution under the privileges of the current user. The vulnerability carries a HIGH severity rating (CVSS 7.8) with a local attack vector requiring no special privileges but necessitating user interaction to open a malicious file. The attack has low complexity, and successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system. Currently, CVE-2026-27287 is not listed on CISA's Known Exploited Vulnerabilities catalog and remains inactive on threat intelligence hot lists, indicating no confirmed active exploitation in the wild. The extremely low EPSS score of 0.00014 suggests minimal real-world attack probability at this time, though organizations running affected InCopy versions should prioritize patching to mitigate future risk.