EUVD-2026-22794Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
Adobe Framemaker versions 2022.8 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could leverage this vulnerability to access sensitive files or data on the system. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Adobe FrameMaker 2022.8 and earlier allows arbitrary file system read through improper input validation when a user opens a malicious file, enabling attackers to access sensitive data on the victim's system. The vulnerability requires user interaction and is classified as information disclosure with a CVSS score of 6.3. No active exploitation or public exploit code has been identified at the time of analysis.
Technical ContextAI
This vulnerability stems from CWE-20 (Improper Input Validation), a fundamental weakness in how the application processes untrusted input from files. FrameMaker's file parsing mechanism fails to properly validate file content before processing, allowing crafted documents to trigger unintended file system access operations. The attack vector is local (AV:L), meaning the attacker must first deliver a malicious file to the victim's system, likely through email, file sharing, or compromised repositories. The low attack complexity (AC:L) indicates minimal conditions are required beyond the file opening action. Adobe FrameMaker versions up to 2022.8 across multiple platforms are affected, as identified through the product CPE lineage for this document editing and publishing application.
RemediationAI
Users should upgrade Adobe FrameMaker to version 2023 or later, which addresses this input validation vulnerability. If immediate upgrade is not feasible, users should avoid opening FrameMaker documents from untrusted sources, exercise caution with file attachments and downloads, and consider restricting FrameMaker file access through endpoint security controls. Adobe's security advisory APSB26-36 provides detailed information and should be consulted for the latest patching guidance and any interim mitigation recommendations. https://helpx.adobe.com/security/products/framemaker/apsb26-36.html
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today