CVE-2026-27294
Published: 14 April 2026
Summary
CVE-2026-27294 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Adobe Framemaker. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Malicious File (T1204.002); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the out-of-bounds read vulnerability in Adobe FrameMaker as addressed in Adobe's APSB26-36 bulletin, eliminating the root cause.
Memory protection mechanisms like ASLR, DEP, and stack canaries directly prevent exploitation of out-of-bounds read vulnerabilities leading to arbitrary code execution.
Malicious code protection via endpoint detection tools can identify and block crafted files or exploit behaviors targeting this Adobe FrameMaker vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds read in FrameMaker file parser enables RCE when victim opens crafted malicious file (AV:L/UI:R), directly mapping to User Execution via Malicious File.
NVD Description
Adobe Framemaker versions 2022.8 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute…
more
code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Deeper analysisAI
CVE-2026-27294, published on 2026-04-14, is an out-of-bounds read vulnerability (CWE-125) affecting Adobe FrameMaker versions 2022.8 and earlier. The issue arises when parsing a crafted file, which can cause a read past the end of an allocated memory structure.
The vulnerability has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation requires local access and user interaction, as a victim must open a malicious file. An attacker who tricks a user into doing so can achieve arbitrary code execution in the context of the current user.
Adobe's security bulletin APSB26-36 addresses this vulnerability and is available at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html.
Details
- CWE(s)