CVE-2026-27293

CVE-2026-27293 is a heap-based buffer overflow vulnerability affecting Adobe FrameMaker versions 2022.8 and earlier that could enable arbitrary code execution within the context of the current user. The vulnerability requires user interaction, specifically the opening of a malicious file, to trigger exploitation. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector, low attack complexity, and no special privileges required. It presents high impact across confidentiality, integrity, and availability. The exploit requires user interaction through opening a malicious file, which somewhat constrains the attack surface. There is currently no evidence of active exploitation in the wild, as the CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog and does not appear on any hot list tracking. The EPSS score of 0.00027 indicates this threat ranks lower than the vast majority of documented vulnerabilities in terms of exploitation probability. Organizations should nevertheless prioritize patching FrameMaker installations, particularly in environments where users regularly handle files from untrusted sources.