The flaw is a NULL pointer dereference in Adobe FrameMaker that can lead to an application crash. The vulnerability is identified as CWE-476. When triggered, the software terminates unexpectedly, causing interrupted service for users. Execution of the flaw requires an attacker to supply a specially crafted file that the victim must open, so user interaction is mandatory for exploitation.

Adobe FrameMaker versions 2022 and 2026 are affected. No specific version ranges are listed in the advisory. All builds of these releases that lack the patch are potentially vulnerable.

The CVSS score of 5.5 indicates moderate severity. EPSS score is < 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The attack vector is local, with the requirement that the victim opens a malicious file; this limits the exploit to scenarios where the user can be tricked or receives a manipulated document. Because the exploitation results only in a denial of service and does not provide privileged code execution, the overall risk is moderate but still operationally disruptive.