What is the CVSS score of CVE-2026-27293?

CVE-2026-27293 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe are affected by CVE-2026-27293?

Adobe FrameMaker 2022.8 and earlier contain a heap-based buffer overflow that allows arbitrary code execution when users open malicious files, exposing organizations to potential data theft and…

How to fix or mitigate CVE-2026-27293?

Within 24 hours: Issue security alert to FrameMaker users prohibiting opening documents from untrusted sources and implementing file review processes. Within 7 days: Deploy application-level restrictions (disable FrameMaker plugins if available) and audit recent file submissions for anomalies. Identify which users run FrameMaker 2022.8 or earlier. Within 30 days: Establish inventory of all FrameMaker installations, contact Adobe for patch timeline and workarounds, and evaluate upgrade feasibility to newer versions when available.

Adobe CVE-2026-27293

EUVD-2026-22782 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-04-14 psirt@adobe.com

GHSA-j2hh-7j22-p596

Heap Overflow Buffer Overflow RCE Adobe

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:10 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22782

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier enables arbitrary code execution with high integrity and confidentiality impact when users open specially crafted malicious files. Attack requires local access and user interaction (CVSS 7.8, AV:L/UI:R), limiting remote exploitation scenarios. No public exploit identified at time of analysis. EPSS data not available, and vulnerability not listed in CISA KEV, suggesting exploitation remains theoretical despite the high CVSS score.

Technical ContextAI

The vulnerability stems from a CWE-122 heap-based buffer overflow in Adobe FrameMaker's file parsing routines. Heap overflows occur when a program writes data beyond the allocated heap memory boundary, corrupting adjacent memory structures. Unlike stack-based overflows, heap corruption can be more complex to exploit but offers attackers control over dynamic memory allocation, potentially hijacking function pointers or vtables. Adobe FrameMaker is a document publishing application for technical documentation, and this flaw likely resides in parsing logic for FrameMaker's proprietary file formats (.fm, .book, or .mif files). The affected versions span the 2022.x release line through version 2022.8, indicating the vulnerability exists in core document processing code shared across these releases.

RemediationAI

Adobe has released security advisory APSB26-36 addressing this vulnerability. Organizations should immediately consult the official advisory at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html for specific patch versions and upgrade instructions. Standard remediation involves upgrading to the patched FrameMaker release identified in APSB26-36. Until patching is complete, implement defense-in-depth controls including user awareness training to avoid opening FrameMaker files from untrusted sources, email attachment filtering to block unsolicited .fm/.book/.mif files, and application allowlisting to prevent unauthorized code execution. Restrict FrameMaker installation to users with legitimate business requirements to reduce attack surface.