CVE-2021-36004
📋 TL;DR
CVE-2021-36004 is an out-of-bounds write vulnerability in Adobe InDesign's CoolType library that allows remote code execution when a user opens a malicious file. Attackers can exploit this to run arbitrary code with the victim's privileges. Users of Adobe InDesign version 16.0 and earlier are affected.
💻 Affected Systems
- Adobe InDesign
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Malware installation or data theft through spear-phishing attacks with malicious InDesign files.
If Mitigated
Limited impact if users avoid opening untrusted files and proper endpoint protection is in place.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious file) but the vulnerability itself is unauthenticated. No public exploit code was available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.1 and later
Vendor Advisory: https://helpx.adobe.com/security/products/indesign/apsb21-22.html
Restart Required: Yes
Instructions:
1. Open Adobe InDesign. 2. Go to Help > Updates. 3. Install available updates to version 16.1 or later. 4. Restart the application.
🔧 Temporary Workarounds
Disable CoolType library
windowsPrevent loading of the vulnerable CoolType library component
Not applicable - requires registry/configuration changes specific to environment
🧯 If You Can't Patch
- Restrict user permissions to limit impact of code execution
- Implement application whitelisting to block unauthorized InDesign execution
🔍 How to Verify
Check if Vulnerable:
Check InDesign version via Help > About InDesign. If version is 16.0 or earlier, system is vulnerable.Check Version:
On Windows: Check registry at HKEY_LOCAL_MACHINE\SOFTWARE\Adobe\InDesign\[Version]\ProductVersionVerify Fix Applied:
Verify version is 16.1 or later in Help > About InDesign.📡 Detection & Monitoring
Log Indicators:
- Unexpected InDesign crashes
- Suspicious file opens from untrusted sources
- Process creation from InDesign with unusual parameters
Network Indicators:
- Downloads of InDesign files from suspicious sources
- Network connections from InDesign to unexpected destinations
SIEM Query:
Process creation where parent_process contains 'indesign' AND (process contains 'cmd' OR process contains 'powershell' OR process contains 'wscript')