A heap-based buffer overflow in Adobe FrameMaker 2022 and 2026 allows an attacker to inject and execute arbitrary code in the context of the current user. This flaw enables the attacker to take control of the application or execute commands without additional privileges. The vulnerability is a classic example of CWE‑122 where an improperly validated buffer can be overrun.

Adobe FrameMaker 2022 and Adobe FrameMaker 2026 are vulnerable. The affected versions are those that have not applied the Adobe security release for this issue.

The CVSS score of 7.8 indicates a high severity, and the lack of a published EPSS score means no current exploitation probability is known. The flaw requires user interaction: a victim must open a malicious file, making the attack vector local. As the vulnerability is not listed in the CISA KEV catalog, no publicly documented exploitation campaigns have been reported, but the potential for arbitrary code execution justifies urgent mitigation.