Adobe FrameMaker EUVD-2026-99232

Exploitation requires the victim to open an attacker-crafted malicious file in Adobe FrameMaker (UI:R) on the local system (AV:L); it cannot be triggered remotely without this user action. No authentication is required of the attacker (PR:N) and no special non-default product configuration is indicated - any installation that opens the malicious file is affected. The primary limiting factors are the mandatory user interaction (social engineering to deliver and have the file opened) and the local attack vector, which together make this a targeted document-based attack rather than an automatable remote compromise. Code executes only with the privileges of the user running FrameMaker, so impact is bounded by that user's rights (S:U, no privilege escalation beyond the current user context).

This is a locally-exploitable, user-interaction-dependent arbitrary code execution flaw (CWE-787 out-of-bounds write) in Adobe FrameMaker, scored CVSS 7.8 with vector AV:L/AC:L/PR:N/UI:R. The CVSS base score is driven high by the triple-High impact (C:H/I:H/A:H from code execution in the current user's context), but the real-world risk is tempered by two significant limiting factors encoded in the same vector: the attack vector is Local (AV:L) and successful exploitation requires the victim to open a malicious file (UI:R). This is the classic 'malicious document' pattern, not a remotely-wormable network flaw. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no positive signal of active or imminent exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' SSVC-style reasoning: exploitation is not automatable (requires per-victim social engineering to deliver and open a file), technical impact is Total (code execution), and exploitation status is None/Unknown. Net assessment: a genuine but not emergency-tier issue - prioritize patching for teams that routinely open externally-sourced FrameMaker/structured-document files, but it does not warrant drop-everything response absent exploitation evidence. Note the signal gaps: EPSS and KEV data are simply absent from the input (not low - unknown), so this is a severity-based prioritization, not an exploitation-based one.

An attacker crafts a malicious FrameMaker document (or embedded file) that triggers the out-of-bounds write and emails or otherwise delivers it to a technical writer or documentation engineer. When the victim opens the file in a vulnerable FrameMaker installation, the memory corruption is triggered and attacker-controlled code executes with the victim's privileges. No public exploit code is identified at time of analysis, and successful attack depends entirely on convincing the user to open the crafted file.