Adobe Framemaker Vulnerability: Arbitrary Code Execution Risk

A critical vulnerability, tracked as CVE-2026-27295, has been identified in Adobe Framemaker versions 2022.8 and earlier. According to the National Vulnerability Database, this flaw involves an out-of-bounds write, a classic memory corruption issue that, if exploited, could lead to arbitrary code execution. This means an attacker could potentially run malicious code on a victim’s system, operating with the privileges of the currently logged-in user.

The severity of this vulnerability is rated HIGH, with a CVSS score of 7.8. The attack vector is local (AV:L), implying an attacker needs local access or close proximity, but the attack complexity is low (AC:L), making it relatively easy to pull off. Crucially, successful exploitation hinges on user interaction: a victim must open a specially crafted, malicious file. This social engineering component is often the weakest link in a defense chain, turning what might seem like a local issue into a significant remote threat if attackers can trick users into opening their payloads. The Common Weakness Enumeration (CWE) associated with this is CWE-787, confirming the out-of-bounds write nature of the bug.