A heap‑based buffer overflow in Adobe Framemaker allows a maliciously crafted file to overwrite memory when it is opened. The vulnerability can enable an attacker to execute arbitrary code within the context of the user who opens the file, potentially compromising that user’s data and system integrity. The flaw is a classic example of unchecked memory write (CWE‑122).

Adobe Framemaker versions 2022.8 and all earlier releases are affected. These include both the desktop application and any integrated components that handle external content. Users who run the software on any platform are susceptible when they open an untrusted file.

The CVSS score of 7.8 indicates high severity, and the lack of an available EPSS score means the exploitation probability is undetermined. The vulnerability does not appear in the CISA KEV catalog, so there is no current evidence of widespread exploitation. The likely attack vector requires a victim to open a malicious document, which means the threat depends on user interaction. If users are exposed to unsolicited or untrusted files, the risk of exploitation is significant. Advisory guidance emphasizes the importance of applying patches to mitigate this risk.