Adobe FrameMaker EUVD-2026-99236

Exploitation requires the attacker to deliver a specially crafted malicious FrameMaker file AND the victim to open that file in a vulnerable installation (Adobe FrameMaker 2026 ≤18.0.0.206 or 2022 ≤17.0.9.866) - this user-interaction requirement (UI:R) is the primary limiting factor. There is no remote network vector (AV:L) and no automated/service-side trigger; the vulnerability cannot be exploited without a user opening attacker-controlled content. No privileges or prior authentication are needed (PR:N), and impact is confined to disclosure of in-process memory, not code execution or data modification.

This is a moderate-severity, low-urgency information-disclosure flaw. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.5) tells a consistent story: exploitation is local (AV:L) and hinges entirely on social engineering - a victim must open an attacker-supplied malicious file (UI:R) - with impact limited to confidentiality (C:H, no integrity or availability effect), matching the out-of-bounds read (CWE-125) that leaks sensitive process memory. All exploitation signals point AWAY from mass risk: no CISA KEV listing, no public POC identified, and no EPSS score was provided in the input, so there is no evidence of active or probable exploitation. There is no SSVC decision data supplied. The one point worth noting for verification is that PR:N (no privileges) coexists with UI:R - the attacker needs no account, but does need to convince a user to open a file, so the practical barrier is user interaction rather than privilege. No key signals conflict; the main gap is the absence of EPSS/POC data, which is an absence of evidence rather than evidence of low risk. Overall this is a genuine but low-priority issue: a high-CVSS confidentiality metric that is heavily gated by local access and user interaction, best handled in routine patch cycles rather than as an emergency.

An attacker crafts a malicious FrameMaker document and delivers it via email or a shared drive to a user of Adobe FrameMaker 2026 or 2022. When the victim opens the file, the out-of-bounds read triggers and leaks adjacent process memory - potentially containing sensitive data such as pointers or document fragments - back to content the attacker can observe or exfiltrate. No public exploit code was identified at time of analysis, and exploitation cannot occur without the victim opening the file.