What is the CVSS score of EUVD-2026-22794?

EUVD-2026-22794 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Framemaker EUVD-2026-22794

| CVE-2026-27299 MEDIUM

Improper Input Validation (CWE-20)

2026-04-14 psirt@adobe.com

Information Disclosure Adobe Framemaker

6.3

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

6.3 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 01:13 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 23:22 euvd

EUVD-2026-22794

Analysis Generated

Apr 14, 2026 - 23:22 vuln.today

CVE Published

Apr 14, 2026 - 23:16 nvd

MEDIUM 6.3

DescriptionCVE.org

Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Adobe FrameMaker 2022.8 and earlier allows arbitrary file system read through improper input validation when a user opens a malicious file, enabling attackers to access sensitive data on the victim's system. The vulnerability requires user interaction and is classified as information disclosure with a CVSS score of 6.3. No active exploitation or public exploit code has been identified at the time of analysis.

Technical ContextAI

This vulnerability stems from CWE-20 (Improper Input Validation), a fundamental weakness in how the application processes untrusted input from files. FrameMaker's file parsing mechanism fails to properly validate file content before processing, allowing crafted documents to trigger unintended file system access operations. The attack vector is local (AV:L), meaning the attacker must first deliver a malicious file to the victim's system, likely through email, file sharing, or compromised repositories. The low attack complexity (AC:L) indicates minimal conditions are required beyond the file opening action. Adobe FrameMaker versions up to 2022.8 across multiple platforms are affected, as identified through the product CPE lineage for this document editing and publishing application.

RemediationAI

Users should upgrade Adobe FrameMaker to version 2023 or later, which addresses this input validation vulnerability. If immediate upgrade is not feasible, users should avoid opening FrameMaker documents from untrusted sources, exercise caution with file attachments and downloads, and consider restricting FrameMaker file access through endpoint security controls. Adobe's security advisory APSB26-36 provides detailed information and should be consulted for the latest patching guidance and any interim mitigation recommendations. https://helpx.adobe.com/security/products/framemaker/apsb26-36.html