SB2026041701

Cybersecurity-Help.Cz • April 17, 2026

The vulnerability exists due to out-of-bounds read in Adobe InCopy when parsing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.

User interaction is required to open a crafted file.

2) Out-of-bounds write (CVE-ID: CVE-2026-27264)

The vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to out-of-bounds write in Adobe InCopy when parsing a crafted file. A remote attacker can trick the victim into opening a crafted file to execute arbitrary code.

User interaction is required to open a crafted file.

Install update from vendor's website.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Adobe InCopy and Illustrator Vulnerabilities Enable Remote Code Execution Two critical vulnerabilities have been identified in Adobe InCopy and Adobe Illustrator, both allowing remote code execution. The vulnerabilities stem from out-of-bounds read and write issues when parsing specially crafted files. Attackers can exploit these vulnerabilities by tricking users into opening malicious files, which requires user interaction. The CVE for the InCopy vulnerability is CVE-2026-27264, published on 2026-03-11. Users of Adobe InCopy and Illustrator are advised to install updates from the vendor's website to mitigate these risks. The vulnerabilities pose a significant threat to users who may inadvertently open compromised files. Immediate action is recommended to prevent potential exploitation. No evidence of active exploitation has been reported as of now. 2 sources 58

Extracted Entities

SB2026041701

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (2)

Platforms (1)