Adobe FrameMaker CVE-2026-103966

Exploitation requires a victim to open an attacker-crafted malicious file in Adobe FrameMaker (UI:R); it is not triggerable remotely or without local user action. There is no network-facing or automatable path - the attacker needs no FrameMaker privileges (PR:N) but must rely on social engineering to deliver and have the file opened. Limiting factors: the requirement for user interaction, the local attack vector, and the fact that code executes only in the context of the current user (no automatic privilege escalation). Exploitation is bounded to systems where FrameMaker is installed and used to open untrusted documents.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a classic client-side file-open vulnerability: the attack vector is LOCAL because exploitation hinges on a victim opening a malicious FrameMaker file, and user interaction is required (UI:R). Impact is high across confidentiality, integrity and availability because successful exploitation yields arbitrary code execution in the context of the current user. No EPSS score, CISA KEV entry, or public POC was supplied in the intelligence set, so by the precision rules this is 'no public exploit identified at time of analysis.' The absence of KEV/EPSS signals means there is no evidence of active or widespread exploitation; realistic risk is therefore moderate and gated by social engineering (the user must be convinced to open a crafted file). This is a genuine but not emergency priority: the HIGH base score reflects severe impact-if-triggered, not ease of mass exploitation. Note the authentication qualifier PR:N reflects that no application privileges are needed, but exploitation still depends entirely on local user action, so it is not remotely reachable without that interaction.

An attacker crafts a malicious FrameMaker document that triggers a heap-based buffer overflow (CWE-122) when parsed, and delivers it to a victim via email or a shared repository. When the victim opens the file in Adobe FrameMaker, the overflow corrupts heap memory and allows arbitrary code execution in the context of that user. No public exploit code was identified in the provided data, and the local attack vector with required user interaction means delivery relies on social engineering.