Adobe Framemaker Use-After-Free Flaw Allows Arbitrary Code Execution

A critical use-after-free vulnerability, identified as CVE-2026-27292, has been reported in Adobe Framemaker. According to the National Vulnerability Database, this flaw affects versions 2022.8 and earlier, creating a significant risk for users.

Exploitation of this vulnerability could lead to arbitrary code execution, granting an attacker the ability to run malicious code in the context of the current user. The National Vulnerability Database further notes that successful exploitation hinges on user interaction; a victim must open a specially crafted, malicious file. This isn’t a drive-by — it requires a bit of social engineering or trickery to get the user to open that booby-trapped document.

The CVSSv3.1 score for this issue is a hefty 7.8 (HIGH), reflecting the severe impact on confidentiality, integrity, and availability should an attacker successfully trigger the bug. The attack vector is local, and while user interaction is required, the complexity is low, making it a tempting target for threat actors if they can get that initial foothold. This is a classic CWE-416, a ‘use after free’ bug, a perennial favorite for memory corruption exploits.