CVE-2026-34631

CVE-2026-34631 is an out-of-bounds write vulnerability affecting Adobe InCopy versions 20.5.2, 21.2 and earlier that could enable arbitrary code execution within the current user's context. The flaw requires user interaction, as victims must open a malicious file to trigger the vulnerability. This represents a local attack vector with no special privileges required and low attack complexity. The vulnerability carries a HIGH CVSS severity rating of 7.8, with high impacts across confidentiality, integrity, and availability. The attack vector is local, and successful exploitation could allow an attacker to execute arbitrary code with the privileges of the affected user. There is currently no evidence of active exploitation in the wild, as the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog and remains inactive on security hotlists. The extremely low EPSS score of 0.00034 indicates minimal real-world exploitation probability at this time. However, organizations using affected InCopy versions should prioritize patching to prevent potential future exploitation.