CVE-2026-27296

CVE-2026-27296 is an integer underflow vulnerability affecting Adobe Framemaker versions 2022.8 and earlier that could enable arbitrary code execution within the context of the current user. The vulnerability requires user interaction, specifically the opening of a malicious file, making it primarily a threat in targeted distribution scenarios. The vulnerability carries a HIGH severity rating with a CVSS score of 7.8, indicating significant risk across confidentiality, integrity, and availability. The attack vector is local with low complexity, requiring no special privileges but necessitating user interaction through file opening. Successful exploitation grants the attacker the ability to execute arbitrary code with the privileges of the affected user. There is currently no indication of active exploitation in the wild, as the vulnerability does not appear on CISA's Known Exploited Vulnerabilities list and is marked as inactive on threat tracking lists. The EPSS score of 0.00027 suggests minimal real-world exploitation activity compared to other vulnerabilities. Organizations should prioritize patching to versions beyond 2022.8 as part of routine vulnerability management but can classify this as lower priority than actively exploited threats.