Description
Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-04-14
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution
Action: Immediate Patch
AI Analysis

Impact

Adobe Framemaker contains a use‑after‑free flaw (CWE‑416) that enables an attacker to execute arbitrary code when a malicious file is opened by a user. The vulnerability is triggered by crafted input, and execution occurs with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the system.

Affected Systems

Adobe Framemaker versions 2022.8 and earlier are affected. The flaw impacts all operating systems supported by those releases.

Risk and Exploitability

The CVSS score of 7.8 indicates a high severity, yet exploitation requires user interaction, limiting the attack vector to social engineering of file opening. EPSS is not available, and the vulnerability is not listed in KEV, but the potential for privilege escalation makes it a significant concern for environments where users routinely open Framemaker documents.

Generated by OpenCVE AI on April 15, 2026 at 00:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Adobe Framemaker to the latest released version that contains the official fix for the use‑after‑free flaw.
  • If a patch cannot be applied immediately, use application whitelisting or restrict the editor to execute only signed or trusted documents.
  • Run Framemaker with the least privilege required and consider sandboxing the application to contain any successful exploitation.
  • Educate users about the risks of opening unknown or unverified Framemaker files and enforce a file‑screening policy.

Generated by OpenCVE AI on April 15, 2026 at 00:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 15 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:framemaker:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows

Wed, 15 Apr 2026 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe framemaker
Vendors & Products Adobe
Adobe framemaker

Wed, 15 Apr 2026 10:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 23:15:00 +0000

Type Values Removed Values Added
Description Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Adobe Framemaker | Use After Free (CWE-416)
Weaknesses CWE-416
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Framemaker
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-04-15T09:13:10.924Z

Reserved: 2026-02-18T22:02:41.396Z

Link: CVE-2026-27292

cve-icon Vulnrichment

Updated: 2026-04-15T09:07:25.891Z

cve-icon NVD

Status : Analyzed

Published: 2026-04-14T23:16:25.993

Modified: 2026-04-15T18:15:47.473

Link: CVE-2026-27292

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-15T14:53:50Z

Weaknesses