EUVD-2026-99235
GHSA-vjmq-vj3h-rvmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious FrameMaker file to victim
-
ExploitVictim opens file in FrameMaker
-
ExecutionTrigger NULL pointer dereference in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious FrameMaker file in a vulnerable version (FrameMaker 2022 ≤17.0.9.866 or FrameMaker 2026 ≤18.0.0.206); this is the specific precondition. Limiting factors are significant: the attack vector is local (AV:L) with no network reach, and it mandatory requires user interaction (UI:R) - the attacker cannot trigger the crash without the victim actively opening the crafted document. No authentication or elevated privileges are needed by the attacker (PR:N), but the dependence on social engineering and local file handling sharply narrows realistic exploitation. |
| Impact | This is a moderate-severity, low-priority issue despite the 5.5 CVSS score. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) describes a local, user-interaction-dependent availability-only impact: an attacker cannot reach the vulnerability over a network and must convince a victim to open a malicious file. The sole impact is a NULL pointer dereference causing an application crash (CWE-476) - there is no confidentiality or integrity loss and no code execution, so the A:H rating reflects an application denial-of-service, not system compromise. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (local vector plus required user interaction matches a file-open crash), so there is no conflict to flag - the realistic risk is low because the worst outcome is a crash of a desktop authoring tool, recoverable by restarting the application. |
| Exploit ScenarioDerived | An attacker crafts a malicious FrameMaker document and delivers it to a victim (e.g., via email or a shared file) under a plausible pretext. When the victim opens the file in a vulnerable FrameMaker version, parsing triggers a NULL pointer dereference and the application crashes, producing a denial-of-service. No public exploit code is referenced for this issue. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in Adobe FrameMaker 2022 (versions ≤ 17.0.9.866) and FrameMaker 2026 (versions ≤ 18.0.0.206) allows an attacker to crash the application by crafting a document that triggers a NULL pointer dereference when the victim opens it. The vulnerability is local in nature (AV:L) and requires user interaction (UI:R) - the victim must actively open the malicious file - with no authentication or privileges required (PR:N), and only availability is impacted while confidentiality and integrity remain unaffected. No public exploit code has been identified and there is no indication of active exploitation (not listed in CISA KEV) at time of analysis, making this a moderate-severity, low-priority issue despite the 5.5 CVSS base score.
RemediationAI
Adobe security bulletin APSB26-172 (https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html) is the authoritative remediation source; patch status is 'Patch available per vendor advisory', and because the supplied data does not include the exact fixed build numbers, administrators should read APSB26-172 to confirm the precise remediated version for each release track before deploying and must not assume a version number that is not published there. As an interim compensating control, block delivery of untrusted FrameMaker documents (.fm, .book, .mif and related project files) to FrameMaker installations - for example via mail gateway attachment filtering and web download controls - accepting the trade-off that legitimate incoming document workflows will be interrupted and will need an out-of-band transfer path. Where document preview or thumbnail generation is enabled in the OS shell or in content-management integrations, disabling those handlers reduces the number of code paths that parse FrameMaker files without an explicit user action; the trade-off is loss of file previews and possibly thumbnail indexing. Running FrameMaker in a restricted, low-integrity or sandboxed context (standard user rights, no access to sensitive shares) does not prevent the crash but confines its blast radius, since the flaw is availability-only and cannot be leveraged for data theft or code execution. Note that the risk here is limited to application disruption, so these operational controls should be weighted accordingly rather than treated as an emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-476 (NULL Pointer Dereference), reported to Adobe PSIRT, occurring in FrameMaker's handling of attacker-supplied document files. When the application parses a crafted file, it dereferences a pointer that has not been initialized or has been set to NULL, producing an unhandled memory access fault that terminates the process rather than allowing further code execution. This places the flaw squarely in the availability-only class: there is no memory corruption, no data exposure, and no integrity impact. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H reflects a low-complexity, local-vector, no-privilege attack that nevertheless depends entirely on the victim opening the malicious document, which is why social engineering rather than network reachability is the practical gating factor. The affected builds, per EUVD-2026-99235, are Adobe FrameMaker 2022 0 ≤ 17.0.9.866 and Adobe FrameMaker 2026 0 ≤ 18.0.0.206; no CPE strings were supplied in the source data, so the version ranges above are the authoritative scope reference.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
File must be opened locally by the victim, so AV:L and UI:R; no attacker privileges needed (PR:N); impact is crash-only, so C:N/I:N and A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Framemaker is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB