Adobe Framemaker versions 2022.8 and earlier contain an untrusted search path flaw that allows an attacker to cause the program to execute a malicious executable located in a tainted search path. The vulnerability can be triggered without user interaction, enabling arbitrary code execution in the context of the current user. If exploited, the attacker can run any code the user can run, potentially compromising the integrity of the system and all data the user has access to.

Adobe Framemaker for Windows, macOS, and Linux distributions released through version 2022.8 and older. The vulnerability is present in all editions that use a search path to locate critical runtime resources.

The high CVSS score of 8.6 indicates a severe risk, and exploitation does not require user interaction, which suggests that a local attacker who can alter or influence the application's search path can succeed. EPSS data is not available, but the significant severity and lack of remediation in KEV imply that exploitation remains realistic. The attack vector is inferred to be local, as the flaw depends on modifying the application’s environment or filesystem.