The vulnerability is an out‑of‑bounds write that can lead to arbitrary code execution in the context of the user running Adobe FrameMaker. The flaw allows an attacker to corrupt memory while processing a malicious file, enabling execution of injected code.

Adobe FrameMaker versions 2022 and 2026 are affected. These products are used for technical documentation and publishing workflows.

With a CVSS score of 7.8 the risk to confidentiality, integrity, and availability is considered high. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires user interaction – a victim must open a crafted FrameMaker file – so it is likely to be limited to social‑engineering attacks or phishing campaigns. While no public exploit is known, the lack of mitigation guidance means the window for compromise could be significant if the environment permits opening unknown files.