EUVD-2026-99233
GHSA-qfj7-v654-qc9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious FrameMaker file to victim
-
ExploitVictim opens file in FrameMaker
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a maliciously crafted FrameMaker file within a vulnerable Adobe FrameMaker build (2026 at or below 18.0.0.206, or 2022 at or below 17.0.9.866); the flaw is in document/file parsing rather than a network service. Limiting factors per the CVSS vector (AV:L, UI:R): there is no remote or unauthenticated network trigger, successful attack depends on social-engineering the user into opening the file, and code executes only with the current user's privileges (S:U, no privilege escalation), so impact is bounded by that account's rights. |
| Impact | This is a credible but not emergency-tier priority. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity flaw with no privileges required but mandatory user interaction, consistent with a file-parsing out-of-bounds write (CWE-787) triggered when a victim opens a malicious document. The key limiting signal is the AV:L + UI:R combination: there is no network-facing remote path, so exploitation depends on social engineering to deliver and have the user open a crafted FrameMaker file. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced - so exploitation probability signals are entirely absent rather than conflicting, and there is no public exploit identified at time of analysis. No SSVC decision data was supplied. Net: a genuine code-execution bug worth patching on a normal cycle, but real-world risk is bounded by the requirement for local file-open user interaction and the relatively narrow deployment footprint of FrameMaker, rather than an actively-exploited, widely-wormable threat. |
| Exploit ScenarioDerived | An attacker crafts a malicious FrameMaker document and delivers it via phishing email, a shared drive, or a download link. When the victim opens the file in a vulnerable FrameMaker build, the out-of-bounds write corrupts memory and executes arbitrary code in the context of the current user. No public exploit code is identified at this time, and the local attack vector with required user interaction makes successful delivery dependent on social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows an attacker to corrupt memory and potentially execute arbitrary code with the privileges of the user who opens a maliciously crafted document. Affected builds are FrameMaker 2026 at or below 18.0.0.206 and FrameMaker 2022 at or below 17.0.9.866. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) confirms there is no network or unauthenticated trigger: exploitation depends on social engineering a victim into opening a booby-trapped file, and any code that runs is confined to the current user's rights with no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a credible but not emergency-tier patching priority.
RemediationAI
Apply the fixed FrameMaker build published by Adobe for the branch in use - Adobe's security bulletin apsb26-172 (https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html) is the authoritative source for those exact version numbers, and the input data does not independently confirm specific fixed build identifiers, so do not assume that simply being above 18.0.0.206 or 17.0.9.866 is sufficient without checking the bulletin. Where immediate upgrade is not possible, compensating controls should target the user-interaction prerequisite: block or quarantine untrusted .fm, .book, and other FrameMaker document types at email gateways and file shares so crafted files cannot reach a user's desktop, and enforce a policy of opening documents shared by external parties only inside a low-privilege sandbox or virtual machine (trade-off: workflow friction and reduced editing convenience, but it contains memory-corruption exploitation to a disposable session). Running FrameMaker as a standard, non-administrator user limits the blast radius of successful code execution because the assessed scope is unchanged and no privilege escalation is possible; conversely, this control does nothing to stop the initial crash or corruption. Additional hardening such as application allow-listing, EDR memory-corruption detection, and disabling automatic preview handlers/mail attachment previews for FrameMaker formats can reduce the chance of inadvertent triggering, with the trade-off of added operational overhead and possible false positives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic memory-safety defect in FrameMaker's parsing of document files, categorized as CWE-787 (Out-of-bounds Write). FrameMaker is a desktop technical-documentation authoring tool that reads complex, binary-rich file formats, and the bug resides in that file-parsing path rather than in any network-facing service - consistent with the AV:L (local) access vector in both the reported and independently assessed CVSS vectors. The UI:R component means the write is only reached after a user opens a crafted file, and PR:N indicates no prior authentication is needed to trigger the code path once the file is opened. Because S:U (scope unchanged) and the execution context is the current user, an attacker gains no elevation beyond the victim's own account; however, C:H/I:H/A:H reflects that a successful exploit can fully compromise confidentiality, integrity, and availability within that user's session. Adobe's PSIRT assigned the issue and published bulletin apsb26-172 covering both the 2026 and 2022 release branches, and ENISA's EUVD entry (EUVD-2026-99233) tracks the same affected build ranges (≤18.0.0.206 and ≤17.0.9.866), corroborating the vendor data.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L and UI:R; no prior auth needed to parse the file so PR:N; memory-corruption code execution yields full C/I/A high.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe FrameMaker (2026 up to 18.0.0.206 and 2022 up to 17.0.9.866) contains a high-severity out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code with the privileges of a user who opens a malicious document. While no public exploit identified at time of analysis and the issue is not in CISA KEV, a successful attack requires social engineering, potentially leading to data compromise within the user's permissions. Leadership should prioritize patching when available and reinforce user vigilance regarding untrusted documents.
No vendor-released patch identified at time of analysis. Interim mitigations include: enforcing user awareness training on opening untrusted documents; implementing application allowlisting and sandboxing for FrameMaker; restricting the use of FrameMaker to trusted files only; deploying EDR to detect anomalous behavior; and isolating FrameMaker in a low-privilege environment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB