What is the CVSS score of CVE-2026-27297?

CVE-2026-27297 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe are affected by CVE-2026-27297?

Adobe FrameMaker 2022.8 and earlier contain a critical arbitrary code execution vulnerability affecting users who open malicious documents, potentially compromising document integrity and enabling…

How to fix or mitigate CVE-2026-27297?

Within 24 hours: Inventory all FrameMaker installations and identify users with versions 2022.8 or earlier; communicate security advisory to affected teams emphasizing document handling procedures. Within 7 days: Implement application control policies restricting FrameMaker document execution from untrusted sources and disable macros/scripting features if available; consider restricting document sharing channels. Within 30 days: Evaluate upgrade feasibility to FrameMaker 2023.x or later versions; establish document validation procedures and user awareness training on social engineering risks specific to file-based attacks.

Adobe CVE-2026-27297

EUVD-2026-22790 HIGH

Integer Underflow (CWE-191)

2026-04-14 psirt@adobe.com

Integer Overflow RCE Adobe

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:11 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22790

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute code in user context by delivering malicious FrameMaker documents that trigger integer underflow during file parsing. Attack requires social engineering to convince targets to open crafted files. No public exploit identified at time of analysis, though CVSS 7.8 severity reflects high impact across confidentiality, integrity, and availability if successfully exploited.

Technical ContextAI

Adobe FrameMaker is an enterprise desktop publishing and technical documentation tool. This vulnerability stems from CWE-191 (Integer Underflow/Wraparound), where arithmetic operations on integer values result in values smaller than the minimum representable value, wrapping around to maximum values. In file parsing contexts, integer underflows commonly occur during buffer size calculations when processing malformed document structures. When an underflow causes a small allocation paired with a large copy operation, memory corruption results, enabling control-flow hijacking and arbitrary code execution. FrameMaker's document format parsing routines fail to validate integer arithmetic during file structure processing, allowing specially crafted documents to trigger this condition.

RemediationAI

Adobe has released security updates addressing this vulnerability in APSB26-36. Users should immediately upgrade to the patched FrameMaker version specified in the vendor advisory at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html. Until patching is complete, organizations should implement defense-in-depth controls including restricting FrameMaker document sources to trusted internal repositories, deploying email attachment scanning to block unsolicited FrameMaker files, educating users about risks of opening documents from untrusted sources, and running FrameMaker in sandboxed or virtualized environments where feasible. Application whitelisting and endpoint detection technologies can provide additional layers of protection during the remediation window.