Adobe FrameMaker CVE-2026-104344

Exploitation requires the victim to open an attacker-crafted malicious file in Adobe FrameMaker (AV:L/UI:R) - there is no remote or unauthenticated network-reachable path, and no exploitation occurs against an idle installation. No elevated privileges or prior authentication to the host are needed (PR:N), and the attacker gains only the privileges of the user who opens the file (S:U, current-user context). The primary limiting factors are the mandatory user interaction (social engineering to open a document) and the requirement that FrameMaker be installed and used to open the file; there is no special non-default configuration prerequisite stated in the advisory.

This is a classic file-format memory-corruption flaw in a desktop application, and its signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) correctly models the attack as local and user-interaction-dependent: despite PR:N (no authentication required), the attacker cannot reach the vulnerable parser remotely or autonomously - a victim must be socially engineered into opening a malicious FrameMaker file, which is why the base score lands at 7.8 (High) rather than Critical. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or mass-scanning potential - this is characteristically a targeted/opportunistic phishing-style vector, not a wormable network bug. Practically, this is a solid patch-management priority for organizations that actually run FrameMaker (technical-documentation and publishing teams) but is NOT a drop-everything emergency comparable to an unauthenticated network RCE; the missing EPSS/KEV/POC signals reduce urgency, though absence of those signals is not proof of safety given the product was patched via an Adobe PSIRT advisory.

An attacker crafts a malicious FrameMaker document (e.g., a .fm or .mif file) that triggers a heap buffer overflow when parsed, and delivers it via email or a shared drive under a plausible pretext. When a targeted user opens the file in Adobe FrameMaker, the overflow corrupts heap memory and allows execution of attacker-controlled code with that user's privileges. No public exploit code was identified in the provided data, so exploitation would currently require the attacker to develop a working heap-overflow exploit.