CVE-2026-84396

Executive Summary

CVE-2026-84396 is a NULL Pointer Dereference vulnerability (CWE-476) in InDesign Desktop that can cause an application denial-of-service condition. An attacker can exploit this issue by convincing a victim to open a malicious file, which crashes the application. The vulnerability carries a CVSS base score of 5.5 (Medium), reflecting a local attack vector, low attack complexity, no privileges required, and user interaction required; the only impacted security property is availability (High).

The affected product family is identified in the NVD description as "InDesign Desktop," a desktop publishing application. Note that the NVD data provided for this CVE lists the vendor and product as "Unknown / Unknown," and no affected version range is enumerated. The CNA title field is empty. Because InDesign is an Adobe product, that vendor attribution is inferred from the well-known product name only; analysts should corroborate against the authoritative Adobe Security Bulletin before acting. No public PoC, exploit code, or Nuclei template exists, and the CVE is not listed in CISA KEV.

Technical Analysis

CVE-2026-84396 is classified as a NULL Pointer Dereference (CWE-476). This memory-safety weakness class occurs when an application dereferences a pointer that is NULL — for example, when a value returned by an allocation, lookup, or parsing operation is assumed to be valid but is not, and the application attempts to read from or write through that null address. On modern operating systems this typically triggers an access violation (Windows) or a segmentation fault (Linux/macOS), which in an unhandled state terminates the process.

The NVD description states the vulnerability resides in InDesign Desktop and that successful exploitation results in an application crash — i.e., a denial-of-service condition affecting the local instance. The description explicitly notes that exploitation requires user interaction and that a victim must open a malicious file. This establishes the attack surface as file parsing/opening within the InDesign desktop application. A crafted file causes the application to reach a code path where a pointer expected to be valid is null, and the subsequent dereference crashes the process.

Important limitations of the available data:

• No affected version range is provided in the NVD/CNA data (Affected Versions: []), so it is not possible to state which specific InDesign releases are vulnerable.
• No function names, class names, file paths, endpoints, or parameters are present in the NVD Description or CNA Title. Accordingly, no code-level function or symbol is identified here. Any such naming would be fabricated and is deliberately omitted.
• The CNA Title is blank and OSV package/version data is not available.

At the vulnerability-class level, a NULL pointer dereference in a document parser is commonly reachable through malformed structure fields, missing optional elements, unexpected value types, or truncated/inconsistent internal references that the parser does not validate before using. This is a general property of the weakness class and not a claim about the specific InDesign implementation. The weakness typically does not permit code execution on its own; its demonstrated impact per the NVD description is process termination (denial of service).

Because the issue is local (AV:L) and requires user interaction (UI:R), the practical delivery vector is a file opened by the victim in the desktop application, not a remotely triggerable network service.

Exploitation Scenarios

No public PoC or exploit code is available. The following chain is inferred strictly from the vulnerability class (CWE-476) and the NVD description, and is described at the class level without inventing implementation specifics.

1. Reconnaissance / target identification. The attacker identifies targets that use InDesign Desktop on workstations. In a targeted scenario this may involve knowing a graphics, marketing, or publishing team uses the software; in an opportunistic scenario the attacker simply distributes a crafted file broadly, relying on the victim having the application installed. There is no network service to scan for; Shodan dorks for this product would help an operator inventory exposed/detected instances but are not required for exploitation of a local file-open vulnerability.

2. Trigger of the specific flaw class. The attacker constructs or obtains a document file that, when opened in InDesign Desktop, drives the parser into a state where a pointer is dereferenced while null. Per the NVD description, the trigger is the act of opening a malicious file. The precise malformed structure that produces the null dereference is not disclosed in the available data and is intentionally not speculated.

3. Payload / execution method. The payload is the malicious document itself, delivered via a channel that induces the victim to open it (email attachment, shared drive, download link, chat). When the victim opens the file, the application dereferences the null pointer and crashes. No further code execution step is described; the outcome is application termination.

4. Post-exploitation impact. Consistent with CVSS availability-only impact (C:N/I:N/A:H), the demonstrated effect is denial of service: the InDesign process crashes. This can cause loss of unsaved work and productivity disruption. There is no evidence in the provided data of confidentiality or integrity impact, code execution, or lateral movement. Repeated delivery could be used for nuisance-level disruption but does not, per available data, escalate beyond DoS.

Analysts should note the absence of any in-the-wild exploitation evidence and the absence of a CISA KEV listing. Treat this as a lower-urgency availability bug relative to exploited code-execution vulnerabilities, while remaining alert to weaponization as a file-based nuisance or disruption vector.

Impact Assessment

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H yields a base score of 5.5 (Medium). Subscore interpretation:

• Attack Vector Local (AV:L): the flaw is reached through local interaction with a file opened on the victim's machine, not exploitable remotely over a network service.
• Attack Complexity Low (AC:L): no special conditions beyond opening the crafted file are described.
• Privileges Required None (PR:N): the attacker needs no prior access or account on the target.
• User Interaction Required (UI:R): the victim must open the malicious file — a key gating factor that reduces exploitability.
• Scope Unchanged (S:U): impact is confined to the vulnerable application.
• Confidentiality None / Integrity None: no data disclosure or modification is described.
• Availability High (A:H): successful exploitation crashes the application, fully denying use of that instance.

Business impact: availability-only, bounded to the InDesign application instance. The primary consequences are loss of unsaved work, workflow interruption for publishing/design staff, and potential for repeat disruption campaigns. Blast radius is limited to individual workstations running the affected application; there is no described server-side, multi-tenant, or lateral impact. Because the affected version range is not enumerated in the available data, organizations cannot rely solely on version-based scoping and should confirm applicability against the authoritative vendor advisory.

Detection Guidance

Sigma Rule

title: Potential InDesign Desktop NULL Pointer Dereference DoS via Malicious File
id: 8f1b2c3d-4e5f-4a6b-9c7d-0e1f2a3b4c5d
status: experimental
description: Detects InDesign Desktop process crashes consistent with CVE-2026-84396 NULL pointer dereference DoS triggered by opening a malicious file.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84396
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: windows
detection:
  selection_proc:
    Image|endswith:
      - '\InDesign.exe'
  selection_crash:
    EventID:
      - 1000
      - 1001
    Provider_Name: 'Application Error'
    Data|contains:
      - 'InDesign.exe'
      - '0xc0000005'
  condition: selection_proc or selection_crash
fields:
  - Image
  - EventID
  - Data
falsepositives:
  - Legitimate application crashes unrelated to malicious files
  - Software updates or driver faults causing access violations
level: low
tags:
  - attack.t1204.002
  - cve.2026.84396

YARA Rule

rule CVE_2026_84396_InDesign_NullDeref_DoS
{
    meta:
        description = "Heuristic detection for potentially malformed InDesign document files associated with CVE-2026-84396 NULL pointer dereference DoS. Generic file-header heuristic; validate before deployment."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84396"
        date = "2026-01-01"
        cve = "CVE-2026-84396"
        severity = "medium"

    strings:
        $idml = "%!PS-Adobe" ascii
        $indd = { 06 06 ED F5 D8 1D 46 E5 BD 31 EF E7 FE 74 B7 1D } // InDesign .indd magic
        $idml_zip = "mimetypeapplication/vnd.adobe.indesign-idml-package" ascii

    condition:
        ($indd at 0) or $idml_zip or ($idml at 0)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-84396 Potential InDesign Document Delivered via Email Attachment (SMTP)"; flow:established,to_server; content:"Content-Disposition|3a| attachment"; nocase; content:".indd"; nocase; distance:0; within:200; classtype:attempted-dos; reference:cve,2026-84396; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-84396; sid:202684396; rev:1;)

Elastic Detection

process where process.name : "InDesign.exe" and event.action : ("process-crashed", "terminated") and
  (process.exit_code : ("0xC0000005", "3221225477", "-1073741819") or message : "access violation")

Splunk SPL Query

index=windows (source="XmlWinEventLog:Application" OR source="WinEventLog:Application")
(EventCode=1000 OR EventCode=1001)
| search (Message="InDesign.exe" AND (Message="0xc0000005" OR Message="Access violation"))
| stats count min(_time) as first_seen max(_time) as last_seen values(Message) as detail by host
| sort - count

Wazuh OSSEC Rule

<group name="windows,application_error,cve-2026-84396,">
  <rule id="2026840" level="5">
    <if_sid>60600</if_sid>
    <field name="win.system.providerName">Application Error</field>
    <field name="win.system.message">InDesign.exe</field>
    <description>CVE-2026-84396: InDesign Desktop application crash (possible NULL pointer dereference DoS)</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
  <rule id="2026841" level="7">
    <if_sid>2026840</if_sid>
    <field name="win.system.message">0xc0000005</field>
    <description>CVE-2026-84396: InDesign access violation consistent with NULL pointer dereference</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or patch reference is available in the provided data.

1. Immediate mitigations:

   • Treat untrusted InDesign document files received via email, chat, or download as suspect. Enforce attachment filtering for design-file types where operationally feasible.
   • Apply email and web gateway detonation/scanning to InDesign documents before delivery to end users.
   • Restrict execution/opening of files from untrusted sources consistent with existing user-interaction controls; reinforce user awareness that opening unexpected files can crash or disrupt applications.
   • Consider application-level controls (e.g., endpoint application control) if the organization can tolerate blocking design-file execution for untrusted sources.
   • Monitor for repeated application crash events (see Detection Guidance) as an indicator of a deliberate disruption campaign.

2. Patch / upgrade steps:

   • No patch is available per the tracked sources (Patch Confidence 0/4, UNPATCHED). Monitor the authoritative Adobe Security Bulletin for InDesign for the corresponding fix, then upgrade to the corrected release and validate the affected version range once the vendor enumerates it.
   • Because affected versions are not listed in the available data, do not assume a given installation is unaffected or affected based on version alone; confirm against the vendor advisory when published.

3. Long-term hardening:

   • Maintain a vulnerability management process that maps desktop creative-application CVEs to installed versions and tracks vendor advisories.
   • Standardize file-opening policy and sandboxing for high-risk, file-parsing desktop applications.
   • Keep endpoint crash telemetry centralized so availability-impact DoS events can be correlated and prioritized.
   • Prefer least-privilege execution for users of content-parsing desktop applications to limit the impact of any defect that later proves more severe than DoS.

References

• NVD — CVE-2026-84396: https://nvd.nist.gov/vuln/detail/CVE-2026-84396
• MITRE CWE-476 — NULL Pointer Dereference: https://cwe.mitre.org/data/definitions/476.html
• MITRE ATT&CK T1204.002 — User Execution: Malicious File: https://attack.mitre.org/techniques/T1204/002/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-84396 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Adobe Security Bulletins (authoritative vendor advisory for InDesign — verify CVE-2026-84396 mapping): https://helpx.adobe.com/security/security-bulletin.html

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-84396 in the provided data. No public PoC, exploit code, or Nuclei template is available.