Adobe FrameMaker CVE-2025-54282

Exploitation requires an attacker to deliver a specially crafted malicious FrameMaker document AND a victim running an affected version (Adobe FrameMaker 2020.9, 2022.7, or earlier) to manually open that file - the parser's handling of crafted file contents triggers the heap overflow. The decisive limiting factors are: (1) the LOCAL attack vector (AV:L) - the attacker cannot trigger this over the network without first getting the file onto the victim's system; (2) mandatory user interaction (UI:R) - the file must be actively opened, so no exploitation occurs without victim action; and (3) the attacker must still socially engineer file delivery and opening. No privileges or FrameMaker authentication are required (PR:N), and code executes only at the privilege level of the current user, not elevated.

This is a genuinely moderate-priority issue rather than a top-tier emergency, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes code execution with full CIA impact, but critically the attack vector is LOCAL and requires user interaction - the description confirms a victim must open a malicious FrameMaker file. This is not a remotely reachable, wormable flaw. The EPSS score of 0.23% (12th percentile) is low, indicating a low modeled probability of exploitation in the near term, which aligns with the local/UI-gated vector. The CVE is NOT on CISA KEV and there is no indication of public exploit code in the provided data, so exploitation status is: no public exploit identified at time of analysis. Because PR:N is present in the CVSS vector, exploitation is unauthenticated in the sense that the attacker needs no FrameMaker account - but it still depends entirely on social-engineering the victim into opening a crafted document. SSVC-style reasoning: exploitation is not observed (no KEV), the flaw is not automatable (requires per-victim user interaction and file delivery), and technical impact is total (code execution as the current user). Net: patch in normal cycle, prioritize for users who routinely open untrusted .fm files, but this does not warrant emergency out-of-band response.

An attacker crafts a malicious FrameMaker document containing data that triggers a heap-based buffer overflow in FrameMaker's file parser, then delivers it via email, a shared drive, or a download disguised as a legitimate manual or document. When the victim opens the file in an affected FrameMaker version (2020.9, 2022.7, or earlier), the overflow corrupts heap memory and the attacker gains arbitrary code execution in the context of the current user. No public proof-of-concept exploit is identified in the available data, and successful execution depends on the victim opening the file (UI:R) on a local system (AV:L).