CVE-2026-27295

CVE-2026-27295 is an out-of-bounds write vulnerability affecting Adobe FrameMaker versions 2022.8 and earlier that could enable arbitrary code execution within the context of the current user. The vulnerability requires user interaction, specifically the opening of a malicious file, to be exploited. This memory safety issue represents a significant risk to organizations using affected FrameMaker versions for document processing and publishing workflows. The vulnerability carries a HIGH severity rating with a CVSS score of 7.8, reflecting its potential for complete system compromise through code execution with elevated privileges. The local attack vector and low attack complexity indicate that a standard user can trigger the vulnerability simply by opening a crafted file, with no special privileges or system configuration required. Impact is severe across confidentiality, integrity, and availability dimensions. Exploitation status indicates this is not currently being leveraged in active campaigns, as evidenced by its absence from the Known Exploited Vulnerabilities catalog and inactive status on threat tracking lists. The extremely low EPSS score of 0.00034 suggests minimal real-world exploitation probability, though organizations should not rely solely on this metric for patching decisions. Adobe has released patches for affected versions, and timely remediation is recommended given the arbitrary code execution risk.