Framemaker CVE-2026-27292

Adobe FrameMaker versions 2022.8 and earlier. Victim must open a malicious file. Local attack vector; no authentication required. Arbitrary code execution in current user context.

The CVSS base score of 7.8 (High) reflects the severe potential impact-complete compromise of confidentiality, integrity, and availability in the victim's user context. However, real-world risk is moderated by several factors. The attack vector is Local (AV:L), requiring the attacker to deliver a malicious file through social engineering (email attachment, download, file share) rather than exploiting network-accessible services. User Interaction Required (UI:R) adds another barrier, as victims must actively open the weaponized document. Attack Complexity is Low (AC:L) and no privileges are required (PR:N), meaning any attacker who can deliver the file can potentially succeed. The vulnerability is not present in CISA's Known Exploited Vulnerabilities catalog, indicating no confirmed active exploitation campaigns. No public proof-of-concept code has been identified in available references. For organizations where FrameMaker is deployed on endpoints with email or web access, the risk is meaningful but not critical-prioritize patching based on whether users regularly open FrameMaker files from untrusted sources. SSVC framework suggests scheduled patching rather than emergency response given the lack of exploitation evidence and local-only attack vector.

An attacker crafts a malicious FrameMaker document (.fm, .book, or .mif file) containing specially structured content designed to trigger the use-after-free condition during parsing. The attacker delivers this weaponized file to a target via spear-phishing email, posing as a legitimate technical documentation update or collaborative editing request. When the victim opens the file in FrameMaker 2022.8 or earlier, the application's parser accesses freed memory, allowing the attacker's payload to execute with the victim's privileges, potentially installing backdoors, stealing credentials, or establishing persistence on the endpoint.