Adobe FrameMaker CVE-2025-54281

Exploitation requires a victim to open a malicious file in Adobe FrameMaker 2020.9, 2022.7 or earlier (per CVSS UI:R and the description). It is a local, client-side attack - not remotely triggerable without user action - so the attacker must first deliver the crafted document and persuade the user to open it in a vulnerable FrameMaker installation. Limiting factors: mandatory user interaction, dependence on the user running an unpatched version, and the desktop-application attack surface (no network service is exposed); code runs only at the privilege level of the current user, not elevated.

This is a legitimately serious client-side memory-corruption flaw but not an urgent mass-exploitation priority. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a local, low-complexity bug requiring user interaction (opening a malicious file) with no prior privileges, yielding full confidentiality/integrity/availability impact as the current user - consistent with the CWE-416 Use After Free leading to arbitrary code execution. The real-world signals argue against high priority: EPSS is only 0.22% (11th percentile), the CVE is NOT in CISA KEV, and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The PR:N in the vector is technically correct (no account needed) but is offset by UI:R - exploitation hinges entirely on social-engineering a victim into opening a crafted document, which is why this is a targeted/opportunistic phishing-style risk rather than a wormable remote threat. No SSVC decision data was provided in the input. Net: a real, patch-worthy vulnerability in a desktop authoring application, but low probability of widespread automated exploitation; prioritize for systems where FrameMaker handles untrusted documents.

An attacker crafts a malicious FrameMaker document (or convinces a victim to open one delivered via email or a shared drive) that triggers the use-after-free during parsing, corrupting memory and executing attacker-controlled code with the privileges of the user running FrameMaker. No public proof-of-concept is referenced, and because the vector is local with required user interaction, the attack depends on social engineering rather than remote network access.