Adobe Framemaker 2022.8 and earlier contain an out‑of‑bounds write flaw that can be used to execute arbitrary code in the context of the user who opens a malicious file. The vulnerability is triggered when a user opens a specially crafted document, allowing an attacker to run code under the victim’s credentials.

The flaw affects Adobe Framemaker versions 2022.8 and all earlier releases. No other products or later versions are listed as vulnerable.

The CVSS score of 7.8 indicates moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation is not yet documented. The likely attack vector is local: an attacker must supply the malicious file to a victim and persuade the victim to open it, which attests that user interaction is required. Under these conditions, the risk to organizations depends largely on internal policies around file handling and user awareness.