CVE-2026-27298
Published: 14 April 2026
Summary
CVE-2026-27298 is a high-severity Type Confusion (CWE-843) vulnerability in Adobe Framemaker. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 7.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the type confusion vulnerability by requiring timely installation of patches for affected Adobe Framemaker versions as per the vendor advisory.
Implements memory safeguards like ASLR and DEP that mitigate exploitation of type confusion flaws for arbitrary code execution.
Malicious code protection scans and blocks malicious Framemaker files exploiting this vulnerability before or during user interaction.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion in FrameMaker file parsing is directly triggered by opening a crafted malicious document (T1204.002), resulting in arbitrary code execution in a client application (T1203).
NVD Description
Adobe Framemaker versions 2022.8 and earlier are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction…
more
in that a victim must open a malicious file.
Deeper analysisAI
CVE-2026-27298 is an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability, classified under CWE-843, affecting Adobe Framemaker versions 2022.8 and earlier. This flaw could result in arbitrary code execution in the context of the current user. The vulnerability received a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and was published on 2026-04-14T23:16:26.930.
Exploitation requires user interaction, specifically a victim opening a malicious file. An attacker with local access and no privileges can craft and deliver such a file, achieving arbitrary code execution with high confidentiality, integrity, and availability impacts upon the victim's interaction.
Adobe's security advisory at https://helpx.adobe.com/security/products/framemaker/apsb26-36.html provides information on mitigation measures for this vulnerability.
Details
- CWE(s)