Security readout for executives and security teams
Plain-English summary
A flaw in Adobe FrameMaker can expose sensitive information from computer memory when a user opens a malicious file. It does not appear remotely exploitable without user involvement, and the supplied sources provide no evidence of active exploitation.
Executive priority
Treat as a normal-priority security update, accelerated for teams frequently exchanging external FrameMaker documents or handling sensitive information. User interaction lowers urgency, but possible high-confidentiality impact warrants timely remediation.
Technical view
CVE-2026-27301 is a heap-based buffer overflow in Adobe FrameMaker 2022.8 and earlier. Successful exploitation requires a victim to open a malicious file and may disclose memory contents. The CVSS 3.1 score is 5.5; integrity and availability impacts are not identified.
Likely exposure
Organizations running FrameMaker 2022.8 or earlier are potentially exposed, particularly where users receive or open untrusted FrameMaker-compatible files. The supplied structured version metadata is ambiguous, so inventories should be checked against Adobe's advisory.
Exploitation context
Exploitation requires local delivery and user interaction. The CVE is not listed as KEV in the supplied bundle, and no cited source establishes active exploitation. Malicious-file handling is the principal documented attack scenario.
Researcher notes
CWE-122 and the CVSS vector support memory disclosure through a locally supplied malicious file. The supplied description identifies 2022.8 and earlier, while structured affected-version data is ambiguous. No patch version, technical root-cause detail, or exploitation evidence is included; consult Adobe's advisory for authoritative remediation details.
Mitigation direction
- Review Adobe's advisory and apply its recommended security update or remediation.
- Identify and prioritize systems running FrameMaker 2022.8 or earlier.
- Restrict opening unsolicited or untrusted FrameMaker files until remediation is complete.
- Use email and endpoint controls to quarantine suspicious document attachments.
Validation and detection
- Inventory installed FrameMaker versions across managed endpoints.
- Confirm remediated versions against Adobe's current advisory.
- Verify vulnerable installations are upgraded or otherwise covered by Adobe guidance.
- Review security telemetry for suspicious files delivered to FrameMaker users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-122: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-27301 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N1.83.6adobeVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://helpx.adobe.com/security/products/framemaker/apsb26-36.htmlCVE reference, adobe · vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Heap-based Buffer Overflow
Heap-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.