Adobe FrameMaker is vulnerable to an out-of-bounds read that can leak sensitive memory contents. The flaw allows an attacker to glean confidential data from memory once a victim opens a malicious file. The impact is limited to data exposure rather than execution of code or denial of service, as the vulnerability is a buffer over-read condition.

Adobe FrameMaker 2022 and Adobe FrameMaker 2026 are affected. Users of either version should verify that they are running the most recent release from Adobe.

The CVSS score of 5.5 indicates a medium severity for this weakness. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. Because an attacker must provide a malicious file that the user opens, exploitation requires user interaction and is therefore a local, user-dependent threat. The overall risk is moderate, conditioned on the likelihood that users will encounter a crafted FrameMaker document.