An out‑of‑bounds write in Adobe FrameMaker can be exploited to execute arbitrary code in the context of the user who opens a malicious document. The weakness is a classic buffer overflow that overwrites adjacent memory locations, allowing an attacker to control program flow and run code of their choice. Because the vulnerability is triggered by processing a specially crafted file, success requires the victim to open that file, giving the attacker indirect control over the system as the logged‑in user.

Adobe FrameMaker versions 2022 and 2026 are affected. The vulnerability has been reported for both releases and only those product lines have documented mitigations. Users running earlier or later versions, or different Adobe products, are not listed as impacted.

The CVSS score of 7.8 denotes high risk, while the EPSS score is not available, making it harder to gauge exploitation probability. The vulnerability is listed as not in CISA’s KEV catalog, suggesting no known widespread exploitation at the time of this analysis. The attack vector is inferred to be a local (user‑initiated) file‑open action, requiring the victim to open a crafted file; therefore the risk is dependent on user behavior and the presence of malicious documents within the environment.