What is the CVSS score of EUVD-2026-22790?

EUVD-2026-22790 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Framemaker are affected by EUVD-2026-22790?

Adobe FrameMaker 2022.8 and earlier contain a critical arbitrary code execution vulnerability affecting users who open malicious documents, potentially compromising document integrity and enabling…

How to fix or mitigate EUVD-2026-22790?

Within 24 hours: Inventory all FrameMaker installations and identify users with versions 2022.8 or earlier; communicate security advisory to affected teams emphasizing document handling procedures. Within 7 days: Implement application control policies restricting FrameMaker document execution from untrusted sources and disable macros/scripting features if available; consider restricting document sharing channels. Within 30 days: Evaluate upgrade feasibility to FrameMaker 2023.x or later versions; establish document validation procedures and user awareness training on social engineering risks specific to file-based attacks.

Framemaker EUVD-2026-22790

| CVE-2026-27297 HIGH

Integer Underflow (CWE-191)

2026-04-14 psirt@adobe.com

RCE Integer Overflow Adobe Framemaker

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:11 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22790

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

HIGH 7.8

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe FrameMaker 2022.8 and earlier allows local attackers to execute code in user context by delivering malicious FrameMaker documents that trigger integer underflow during file parsing. Attack requires social engineering to convince targets to open crafted files. No public exploit identified at time of analysis, though CVSS 7.8 severity reflects high impact across confidentiality, integrity, and availability if successfully exploited.

Technical ContextAI

Adobe FrameMaker is an enterprise desktop publishing and technical documentation tool. This vulnerability stems from CWE-191 (Integer Underflow/Wraparound), where arithmetic operations on integer values result in values smaller than the minimum representable value, wrapping around to maximum values. In file parsing contexts, integer underflows commonly occur during buffer size calculations when processing malformed document structures. When an underflow causes a small allocation paired with a large copy operation, memory corruption results, enabling control-flow hijacking and arbitrary code execution. FrameMaker's document format parsing routines fail to validate integer arithmetic during file structure processing, allowing specially crafted documents to trigger this condition.

RemediationAI

Adobe has released security updates addressing this vulnerability in APSB26-36. Users should immediately upgrade to the patched FrameMaker version specified in the vendor advisory at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html. Until patching is complete, organizations should implement defense-in-depth controls including restricting FrameMaker document sources to trusted internal repositories, deploying email attachment scanning to block unsolicited FrameMaker files, educating users about risks of opening documents from untrusted sources, and running FrameMaker in sandboxed or virtualized environments where feasible. Application whitelisting and endpoint detection technologies can provide additional layers of protection during the remediation window.