Adobe FrameMaker has a heap‑based buffer overflow that lets an attacker run code with the privileges of the user who opens a crafted file. The flaw occurs when the application processes a maliciously crafted document, allowing the attacker to inject arbitrary instructions into the user's memory space.

The vulnerability affects Adobe FrameMaker 2022 and Adobe FrameMaker 2026.

The CVSS score of 7.8 marks this as a high‑severity issue, yet exploitation requires the victim to manually open a malicious file, which limits automated attacks. No EPSS score is available and the flaw is not listed in CISA’s KEV catalog, suggesting it has not yet been broadly exploited. Nonetheless, the potential for code execution remains significant, especially in environments where users routinely open untrusted documents.