Adobe FrameMaker EUVD-2026-99231

Exploitation requires the victim to open a maliciously crafted file in Adobe FrameMaker (UI:R) - it cannot be triggered remotely or without user action. The attack is local (AV:L): the attacker must first deliver the malicious document to the target via email, download, or shared storage. No authentication or elevated privileges are required of the attacker (PR:N), and code executes only with the privileges of the user who opens the file, so a low-privileged user account limits the blast radius. The main limiting factors are the need for social engineering to induce file-opening and the requirement that the victim actually have FrameMaker installed and use it to open the attacker-controlled file.

This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a local, low-complexity, unauthenticated-but-user-interaction-dependent flaw with full confidentiality, integrity and availability impact in the current user's context. The local attack vector (AV:L) combined with required user interaction (UI:R) materially lowers real-world risk compared to a network-exploitable RCE: an attacker cannot trigger this remotely without first delivering a malicious file and convincing a victim to open it in FrameMaker. No EPSS score was provided in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis - all three exploitation-probability signals are either absent or negative. There is no conflict between the CVSS vector and the description: both consistently point to local, file-based, user-interaction-dependent exploitation. The primary caveat is data sparseness - the only reference is the Adobe advisory APSB26-172, and no independent exploitation telemetry (EPSS/KEV/POC) is available to refine the likelihood estimate.

An attacker crafts a malicious FrameMaker document (e.g. .fm/.book or an imported file format) that triggers the use-after-free condition and emails or otherwise delivers it to a target. When the victim opens the file in Adobe FrameMaker, the freed-object reuse is triggered and arbitrary code executes in the context of the current user. No public exploit code is identified at time of analysis, and successful execution depends entirely on the victim opening the attacker-supplied file.