EUVD-2026-99228
GHSA-mh7f-4wmq-848m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted FrameMaker file to victim
-
ExploitVictim opens malicious file
-
ExecutionTrigger out-of-bounds read in parser
-
ImpactDisclose adjacent process memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious FrameMaker file in a vulnerable build (FrameMaker 2026 ≤18.0.0.206 or FrameMaker 2022 ≤17.0.9.866); there is no remote or network-triggerable path. Limiting factors: the local attack vector (AV:L) and mandatory user interaction (UI:R) mean the attacker must socially engineer the victim into opening the file, and impact is confined to disclosure of in-memory data (C:H, I:N, A:N) with no code execution or system compromise, so success also depends on sensitive data residing in reachable memory at read time. |
| Impact | This is a moderate-severity, low-urgency issue rather than a top priority. The CVSS 3.1 base score of 5.5 (vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) shows a LOCAL attack vector requiring user interaction, with impact limited to confidentiality (C:H) - no integrity or availability effect - which is consistent with an out-of-bounds read (CWE-125) that discloses sensitive process memory. Although PR:N technically means no prior authentication, the AV:L + UI:R combination means an attacker cannot reach the flaw remotely or autonomously; a victim must be socially engineered into opening a malicious FrameMaker file, which substantially lowers real-world exploitability. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active or imminent exploitation - exploitation status is 'no public exploit identified at time of analysis.' No signals conflict here; rather, key prioritization data (EPSS, SSVC, POC status) is simply ABSENT, so risk ranking relies on CVSS and product context alone. Net assessment: a legitimate memory-disclosure bug worth patching in the normal Adobe quarterly cycle, but not an emergency given local vector, required user interaction, and no confirmed exploitation. |
| Exploit ScenarioDerived | An attacker crafts a malicious FrameMaker document (e.g., a .fm or MIF/book file) and delivers it via email or a shared drive to a technical writer. When the victim opens the file in a vulnerable FrameMaker build, the parser reads past an allocated buffer and leaks adjacent process memory, which the attacker can use to recover sensitive in-memory data. No public exploit code was identified in the provided data, and the local vector plus required user interaction make this a targeted social-engineering scenario rather than mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Adobe FrameMaker 2026 (builds up to and including 18.0.0.206) and FrameMaker 2022 (builds up to and including 17.0.9.866) contain an out-of-bounds read that allows an attacker to disclose sensitive contents of process memory when a victim opens a specially crafted document. Exploitation is strictly local and depends on user interaction - the victim must open the malicious file - and the resulting impact is limited to information disclosure, with no code execution or system compromise (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, 5.5). No public exploit code has been identified at time of analysis and there is no indication of active exploitation, making this a low-urgency issue requiring remediation through the vendor advisory rather than emergency action.
RemediationAI
Apply the vendor update referenced in Adobe Security Bulletin APSB26-172 (https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html), which is the authoritative source for the patched builds; affected installs are FrameMaker 2026 up to and including 18.0.0.206 and FrameMaker 2022 up to and including 17.0.9.866, so anything at or below those build numbers should be upgraded. Patch availability is confirmed by the vendor advisory, but the exact fixed version numbers were not supplied in the intelligence provided and should be read directly from the bulletin rather than assumed. Because exploitation requires a victim to open an attacker-supplied file, the most effective compensating controls target that precondition: enforce Windows Mark-of-the-Web / Protected View style policies and endpoint attachment sandboxing so untrusted .fm/.book files are detonated in a disposable environment, block or strip FrameMaker file types at email and web gateways, and disable shell preview/thumbnail handlers for FrameMaker documents so files are not parsed merely by being selected in Explorer - with the trade-off that these controls break legitimate document workflows and normalization can alter files. If patching must be deferred, restrict FrameMaker usage to trusted internal documents on segregated hosts and remove or limit access to sensitive data on workstations where untrusted documents are opened, accepting that this degrades usability and does not eliminate the vulnerability. Note that no public exploit code has been identified at time of analysis, so emergency mitigations are not warranted; track the advisory instead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic out-of-bounds read (CWE-125) in the Adobe FrameMaker document parsing path. When FrameMaker processes a malformed file, an unchecked length or index causes the parser to read past the end of an allocated buffer, and the resulting memory contents - which may include heap data, pointers, or other sensitive in-memory artifacts - can be surfaced or leaked to the attacker-supplied retrieval path. Because the primitive is a read and not a write, the integrity and availability impacts are nil (I:N/A:N) while confidentiality is high (C:H); the local attack vector (AV:L) and required user interaction (UI:R) mean there is no remotely triggerable, unauthenticated path, so a successful attack depends both on social engineering the victim into opening the file and on sensitive data being resident in reachable memory at read time. The source classifications for this record include a 'Buffer Overflow' tag, but the assigned CWE-125 and the assessed CVSS vector confirm that the actual primitive is an out-of-bounds read used for information disclosure, not a writable overflow enabling code execution. The underlying technology is Adobe's FrameMaker desktop publishing/DITA authoring suite, whose proprietary document format parser is the attack surface, as reflected by the EUVD-listed affected builds FrameMaker 2026 ≤18.0.0.206 and FrameMaker 2022 ≤17.0.9.866.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
File must be opened locally so AV:L and UI:R; no authentication needed so PR:N; an out-of-bounds read leaks memory giving C:H with no I or A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB