What is the CVSS score of CVE-2026-27292?

CVE-2026-27292 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Framemaker are affected by CVE-2026-27292?

Adobe FrameMaker 2022.8 and earlier contains a use-after-free vulnerability (CVSS 7.8) that allows local attackers to execute arbitrary code by delivering malicious files to users.

How to fix or mitigate CVE-2026-27292?

Within 24 hours: Identify and inventory all FrameMaker 2022.8 and earlier deployments across the organization; restrict file-opening capabilities via endpoint controls if feasible. Within 7 days: Issue security advisory to FrameMaker users warning against opening files from untrusted sources; implement application whitelisting or disable FrameMaker launch of suspicious file types. Within 30 days: Contact Adobe for patch availability timeline; evaluate migration to FrameMaker 2023.x or later versions if patches become available; implement compensating controls such as sandboxed document handling or user privilege reduction.

Framemaker CVE-2026-27292

EUVD-2026-22780 HIGH

Use After Free (CWE-416)

2026-04-14 psirt@adobe.com

GHSA-34mc-mx9w-h5cv

RCE Denial Of Service Use After Free Memory Corruption Adobe Framemaker

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22780

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute malicious code with current user privileges by tricking victims into opening specially crafted files. This use-after-free memory corruption vulnerability requires no authentication but depends on user interaction. No confirmed active exploitation (not in CISA KEV) or public proof-of-concept identified at time of analysis, though the local attack vector and user interaction requirement reduce immediate remote threat surface compared to network-accessible vulnerabilities.

Technical ContextAI

This vulnerability stems from a use-after-free condition (CWE-416) in Adobe FrameMaker, a desktop publishing application for technical documentation. Use-after-free vulnerabilities occur when an application continues to use a memory pointer after the memory has been freed, allowing attackers to manipulate freed memory and redirect program execution flow. In FrameMaker's file parsing logic, processing maliciously crafted documents triggers access to previously deallocated memory objects. Successful exploitation enables attackers to control program execution and run arbitrary code with the privileges of the user running FrameMaker. The vulnerability affects FrameMaker versions 2022.8 and all earlier releases, indicating a longstanding flaw in the application's memory management during document processing.

RemediationAI

Organizations should upgrade all Adobe FrameMaker installations to the patched version specified in Adobe Security Bulletin APSB26-36, available at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html. Adobe typically releases patches that increment beyond the vulnerable version numbering, so the fixed release will be a version later than 2022.8, with exact version details provided in the bulletin. Until patching is complete, implement defense-in-depth controls including instructing users to open FrameMaker documents only from trusted sources, deploying email attachment scanning to detect potentially malicious FrameMaker files, and enabling application whitelisting or endpoint detection and response solutions to detect abnormal FrameMaker process behavior. Consider restricting FrameMaker use to necessary personnel and air-gapping systems used for processing externally sourced technical documentation if immediate patching is not feasible.