EUVD-2026-99229
GHSA-j23r-crpf-7qh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious FrameMaker file to victim
-
DeliveryVictim opens file in FrameMaker
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user context and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open a malicious file in Adobe FrameMaker (UI:R) - it is not triggerable remotely or without user action. The attacker needs no prior privileges or authentication on the target (PR:N), but delivery depends on social engineering the user into opening attacker-supplied FrameMaker content. The attack is local (AV:L), so FrameMaker must be installed and used to process the file; impact is confined to the current user's context (S:U), meaning a low-privilege user who opens the file yields only that user's privileges, not automatic system compromise. |
| Impact | The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description: this is a local (AV:L), file-based out-of-bounds write (CWE-787) that requires a victim to open a malicious file (UI:R). Despite PR:N, exploitation is NOT remote-unauthenticated in practice - the local attack vector plus required user interaction means an attacker must socially engineer a target into opening a crafted FrameMaker document. No EPSS score, KEV listing, or public POC was supplied in the input, so there is no signal of active or imminent exploitation: exploitation status is 'no public exploit identified at time of analysis.' This profile - high technical impact (code execution as the current user) but a niche, non-server, interaction-gated desktop product - makes it a standard patch-cycle priority rather than an emergency. It mirrors the typical Adobe PSIRT file-parsing memory-corruption bug: serious if triggered, but gated behind user action and a limited deployment base. Note the absence of EPSS/KEV/POC is a lack of data, not evidence of safety; and the FrameMaker-specific affected versions are not enumerated in the input (only an APSB advisory link is provided). |
| Exploit ScenarioDerived | An attacker crafts a malicious FrameMaker (e.g., .fm/.book or imported-format) file that triggers the out-of-bounds write when parsed, then delivers it via email, a shared drive, or a download disguised as legitimate documentation. When the victim opens the file in Adobe FrameMaker, memory corruption leads to arbitrary code execution in the context of that user. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write (CWE-787) in Adobe FrameMaker allows arbitrary code execution in the context of the current user when a victim opens a crafted FrameMaker document. Exploitation is file-based and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 HIGH): the attacker must socially engineer the target into opening malicious content, and the resulting code runs with only that user's privileges rather than gaining system-level control. No confirmed active exploitation or publicly available exploit code was identified at time of analysis, but the full confidentiality, integrity, and availability impact makes prompt patching important for engineering and technical-publishing environments that routinely exchange FrameMaker files.
RemediationAI
Patch status is not confirmed in the available source data - no exact fixed version number was provided in this record, so validate the update tier against Adobe's bulletin APSB26-172 (https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html) and apply the FrameMaker release it designates, rather than assuming any specific build number. Until that update is verified and deployed, treat every inbound FrameMaker document from outside your trust boundary as hostile: strip or quarantine .fm, .book, .mif, and related FrameMaker attachments and archives at the email gateway and file-sharing tier (trade-off: legitimate vendor-supplied documentation must be routed through a reviewed intake channel), and enforce Mark-of-the-Web / Protected View-style restrictions so externally sourced files open in the most restricted mode the product supports (trade-off: some macro, scripting, or linked-resource features may be blocked, requiring per-user exceptions). Operate FrameMaker as a standard, non-administrative user and keep the host free of cached credentials and reachable high-value shares, since the assessed scope limits code execution to the current user's privileges and thereby caps the blast radius of a successful open (trade-off: none significant for productivity, but it forces admins to have separate privileged accounts). Complement with EDR or application-level exploit mitigation on endpoints processing these files, which may catch the malformed-write behavior but is not a substitute for the vendor fix, and monitor for suspicious child processes or file writes spawned from FrameMaker, an indicator that a malicious document was successfully opened.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a memory-safety defect in Adobe FrameMaker's handling of document data, classified as an out-of-bounds write under CWE-787 (improper validation of the size or bounds of a write into an allocated buffer). When FrameMaker parses attacker-controlled file content, the malformed structure causes the application to write past the end of an intended buffer, corrupting adjacent memory. This class of bug - commonly a heap or stack buffer overflow, consistent with the supplied tags 'Buffer Overflow' and 'Memory Corruption' - is typically leveraged by overwriting adjacent data structures or control data and redirecting execution flow, which is how it converts into arbitrary code execution. The assessed vector places the attack surface in the document-parsing path invoked when a user opens a file (AV:L, UI:R), requires no attacker-held credentials, privileges, or account on the host (PR:N), and is scoped to the current user's security context (S:U) - meaning the malicious code inherits the privileges of whoever opened the file, and that a low-privilege user opening the document yields only that user's access, not automatic administrative or system compromise. There is no network-service component and no remote trigger: delivery depends entirely on tricking the victim into opening attacker-supplied FrameMaker content from an email attachment, download, or shared location.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally in FrameMaker so AV:L and UI:R; attacker needs no prior privileges (PR:N); crafted file reliably triggers the OOB write (AC:L) yielding full code execution in the user context (C:H/I:H/A:H, S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe FrameMaker is affected by CVE-2026-103967, a HIGH-severity out-of-bounds write that can execute code as the user who opens a crafted FrameMaker document. Technical-publishing, engineering, and documentation teams that routinely exchange FrameMaker files are most exposed, and a successful attack could compromise user-level data and disrupt production workflows. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis; leadership should prioritize interim file-handling controls and immediate vendor-patch tracking.
No vendor-released patch identified at time of analysis. Interim mitigations include blocking or quarantining untrusted FrameMaker document types at email/web gateways, enforcing least privilege and application allowlisting, opening untrusted documents only in isolated/sandboxed VMs, disabling FrameMaker file associations for high-risk users, and monitoring EDR for suspicious FrameMaker child processes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB