Adobe FrameMaker 2022 and 2026 are vulnerable to an out‑of‑bounds read (CWE‑125). This flaw allows a maliciously crafted file to cause the application to read memory beyond the intended bounds, potentially exposing sensitive information from the victim's memory space. The vulnerability does not provide code execution or privilege escalation, but it can lead to the disclosure of confidential data present in memory at the time the file is opened.

The affected products are Adobe FrameMaker 2022 and Adobe FrameMaker 2026, as specified by Adobe. No specific patch level or version numbers are listed, so all installations of those products remain at risk until a vendor update addresses the flaw.

The CWE‑125 condition is scored moderate with a CVSS of 5.5. The EPSS score is not available, and the flaw is not listed in the CISA KEV catalog, indicating no known widespread exploitation. Exploitation requires the victim to open a malicious file; thus a user‑interaction prerequisite limits the attack surface primarily to individuals who receive suspicious documents and choose to open them. The overall risk remains moderate and mitigated by user awareness and caution.