CVE-2026-27294

CVE-2026-27294 is an out-of-bounds read vulnerability affecting Adobe FrameMaker versions 2022.8 and earlier. When parsing a crafted file, the flaw allows attackers to read past the end of allocated memory structures, potentially enabling arbitrary code execution within the current user's context. Successful exploitation requires user interaction, as a victim must open a malicious file. The vulnerability carries a CVSS score of 7.8 (HIGH) with a local attack vector, low complexity, and no privilege requirements. It poses high impact across confidentiality, integrity, and availability. The EPSS score of 0.00027 indicates this vulnerability is less prevalent in active exploitation compared to the broader CVE landscape, ranking higher than only 0.076% of all documented vulnerabilities. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and is categorized as inactive on vulnerability tracking hot lists. There is no publicly available evidence of active exploitation or readily available exploit code in the community. Organizations should prioritize updating to patched FrameMaker versions, though immediate critical action is not warranted given the current low exploitation activity.