Adobe FrameMaker EUVD-2026-99237

Exploitation requires the victim to open an attacker-supplied malicious FrameMaker document in Adobe FrameMaker (AV:L with UI:R), making social engineering and user interaction mandatory prerequisites - there is no remote, interaction-free attack path. The attacker needs no prior authentication or privileges on the target (PR:N) and executes code only in the context of the user who opens the file (scope unchanged, S:U), so impact is bounded by that user's privilege level. The primary limiting factors are the need to deliver the file to and have it opened by a victim, and the requirement that the victim run a vulnerable FrameMaker version; there is no indication a non-default configuration is required.

This is a classic file-format parsing memory-corruption flaw with a moderate-to-high real-world risk ceiling rather than an emergency. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) scores 7.8 (High), and its key constraint is that the attack vector is LOCAL and requires user interaction - the victim must be socially engineered into opening a malicious file, so this is not a remotely-wormable, network-reachable bug. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, meaning there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by the C:H/I:H/A:H impact (arbitrary code execution in the current user's context) rather than by demonstrated in-the-wild activity. There is no SSVC decision data, EPSS probability, or automatability signal supplied, so exploitation likelihood cannot be quantified from the input. The signals are internally consistent (local vector + required user interaction matches a malicious-document scenario), so there is no contradiction to flag; the main limiting factor is that exploitation hinges entirely on user interaction, which caps realistic risk well below that of an unauthenticated network RCE.

An attacker crafts a malicious FrameMaker document (e.g., a .fm or similar file) containing malformed structures that trigger the heap-based buffer overflow in FrameMaker's file parser, then delivers it via email or a download masquerading as legitimate documentation. When the victim opens the file in a vulnerable version of Adobe FrameMaker, the overflow corrupts heap memory and allows arbitrary code execution in the context of the current user. No public exploit code was identified in the provided data, so this scenario reflects the documented capability rather than a confirmed working exploit.