CVE-2026-27292
Published: 14 April 2026
Summary
CVE-2026-27292 is a high-severity Use After Free (CWE-416) vulnerability in Adobe Framemaker. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 11.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2026-27292 is a Use After Free vulnerability (CWE-416) affecting Adobe FrameMaker versions 2022.8 and earlier. The flaw could result in arbitrary code execution in the context of the current user, with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H).
Exploitation requires user interaction, as a victim must open a malicious file. An attacker with local access and no privileges can craft and deliver such a file, achieving arbitrary code execution with low complexity upon the victim's interaction.
Adobe's security bulletin APSB26-36, published on April 14, 2026, details the vulnerability and mitigation recommendations, available at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22780
Vulnerability details
Adobe Framemaker versions 2022.8 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must…
more
open a malicious file.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in desktop document app enables arbitrary code execution triggered by opening attacker-crafted file (T1203: Exploitation for Client Execution; T1204.002: User Execution via Malicious File).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and remediation of the Use After Free flaw in vulnerable Adobe FrameMaker versions to prevent exploitation.
Implements memory protections like non-executable memory regions and address space randomization that hinder successful arbitrary code execution from the Use After Free vulnerability.
Enables vulnerability scanning to identify systems running vulnerable versions of Adobe FrameMaker affected by CVE-2026-27292.