CVE-2024-39395
📋 TL;DR
Adobe InDesign has a NULL pointer dereference vulnerability that allows attackers to crash the application by tricking users into opening malicious files. This affects InDesign Desktop versions ID19.4, ID18.5.2 and earlier. The vulnerability results in denial-of-service but requires user interaction to exploit.
💻 Affected Systems
- Adobe InDesign Desktop
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Targeted user opens malicious file causing InDesign to crash, losing unsaved work and disrupting productivity.
Likely Case
User inadvertently opens crafted file from untrusted source, causing application crash and potential data loss.
If Mitigated
With proper controls, users avoid opening untrusted files, limiting impact to isolated crashes.
🎯 Exploit Status
Exploitation requires user to open malicious file; no authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ID19.5 and ID18.5.3
Vendor Advisory: https://helpx.adobe.com/security/products/indesign/apsb24-56.html
Restart Required: Yes
Instructions:
1. Open Adobe Creative Cloud application. 2. Navigate to 'Apps' tab. 3. Find InDesign and click 'Update'. 4. Restart computer after installation completes.
🔧 Temporary Workarounds
Restrict file opening
allConfigure InDesign to only open files from trusted sources using application restrictions.
🧯 If You Can't Patch
- Implement application whitelisting to block execution of older InDesign versions.
- Educate users to never open InDesign files from untrusted sources.
🔍 How to Verify
Check if Vulnerable:
Check InDesign version via Help > About InDesign. If version is ID19.4 or earlier, or ID18.5.2 or earlier, system is vulnerable.Check Version:
On Windows: Check via Control Panel > Programs. On macOS: Check via About This Mac > System Report > Applications.Verify Fix Applied:
Verify version is ID19.5 or later, or ID18.5.3 or later after patching.📡 Detection & Monitoring
Log Indicators:
- Application crash logs from InDesign
- Unexpected termination events in system logs
Network Indicators:
- None - exploitation is file-based, not network-based
SIEM Query:
EventID=1000 OR EventID=1001 AND SourceName='InDesign' AND Keywords='Application Error'