Description
Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

Adobe FrameMaker has an out‑of‑bounds write that can allow an attacker to execute arbitrary code with the privileges of the current user. The bug is triggered when a user opens a specially crafted file, so it requires user interaction to be exploited. If successfully leveraged, the attacker can run arbitrary commands or install malware on the victim’s system.

Affected Systems

The vulnerability affects Adobe FrameMaker 2022 and Adobe FrameMaker 2026. No specific patch version is mentioned, but the affected releases should be updated to the latest available security build.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Exploitation requires the victim to open a malicious file, which limits the attack surface but still represents a significant risk if users are not cautious or if the application is used in an untrusted environment.

Generated by OpenCVE AI on October 17, 2026 at 06:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Adobe FrameMaker security update released for versions 2022 and 2026.
  • Enforce policies that prevent users from opening untrusted or unknown files, and verify file integrity before opening.
  • Run FrameMaker in a sandboxed or restricted‑permission environment to limit potential damage from exploitation.

Generated by OpenCVE AI on October 17, 2026 at 06:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe adobe Framemaker 2022
Adobe adobe Framemaker 2026
Vendors & Products Adobe
Adobe adobe Framemaker 2022
Adobe adobe Framemaker 2026

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Adobe Framemaker | Out-of-bounds Write (CWE-787)
Weaknesses CWE-787
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Adobe Framemaker 2022 Adobe Framemaker 2026
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T03:59:52.628Z

Reserved: 2026-10-01T16:04:49.331Z

Link: CVE-2026-103967

cve-icon Vulnrichment

Updated: 2026-10-13T19:04:50.332Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T19:17:54.663

Modified: 2026-10-14T15:50:50.180

Link: CVE-2026-103967

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T22:50:13Z

Weaknesses