Adobe Framemaker versions 2022.8 and earlier contain an access of an uninitialized pointer that can expose memory contents. This flaw allows an attacker to read sensitive data from the victim’s system when a malicious file is opened. The vulnerability does not provide direct remote code execution or denial of service; its primary consequence is the disclosure of confidential information.

Affected products are Adobe Framemaker 2022.8 and all earlier releases distributed by Adobe. All users running those versions are potentially vulnerable and should verify their installed version against the latest available update.

The CVSS score of 5.5 indicates a moderate risk to confidentiality. Exploitation requires the victim to interact with a crafted file, so the likelihood of attack is limited to social engineering scenarios. There are no publicly known exploits listed, and the vulnerability is not included in the CISA KEV catalog, meaning active exploit activity has not been documented. Nonetheless, organizations should treat the flaw with caution due to its impact on sensitive data exposure.