# CVE-2026-106625: Adobe FrameMaker out-of-bounds write in file parsing

Source: https://junglewise.ai/threats/cve-2026-106625-adobe-framemaker-is-affected-by-an-out-of-bounds-write  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106625 · Severity: high · CVSS 7.8 · Published 2026-10-13

Adobe FrameMaker, a document publishing application, contains an out-of-bounds write vulnerability that allows attackers to execute arbitrary code when a user opens a malicious file. This could enable attackers to take full control of the user's system, access sensitive documents, or install malware. The attack requires no special privileges and affects both the 2026 and 2022 product lines.

Technologies: [Adobe Framemaker](https://junglewise.ai/threats/technologies/framemaker). Vendors: [Adobe](https://junglewise.ai/threats/vendors/adobe).

## Quick answers

**Is CVE-2026-106625 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106625 being exploited in the wild.

**How severe is CVE-2026-106625?** High severity, with a CVSS score of 7.8, published 13 October 2026.

**Which products and versions are affected?** Adobe Framemaker 2026 18.0.0.206 and earlier, 2022 17.0.9.866 and earlier.

**Is there a fix for CVE-2026-106625?** Yes: fixed in FrameMaker 2026 18.0.1.312, FrameMaker 2022 17.0.10.928. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106625 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-106625?** Check whether you run Adobe Framemaker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FrameMaker 2026 18.0.1.312, FrameMaker 2022 17.0.10.928

## Technical details

This is an out-of-bounds write vulnerability (CWE-787) in FrameMaker's file parsing logic that permits arbitrary code execution in the context of the current user. The attack vector is local with required user interaction—a victim must open a specially crafted malicious document file. Adobe has released patches addressing this and multiple related memory corruption bugs across both FrameMaker 2026 and 2022 versions.

## Affected products

- Adobe FrameMaker 2026 18.0.0.206 and earlier, 2022 17.0.9.866 and earlier

## Timeline

- 2026-10-13: disclosed

## References

- [https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html](https://www.adobe.com/trust/security/products/framemaker/apsb26-172.html)

## Related threats

- [Adobe FrameMaker heap buffer overflow in file processing](https://junglewise.ai/threats/cve-2026-27301-adobe-framemaker-heap-buffer-overflow-in-file-processing)
- [Adobe FrameMaker uninitialized pointer access memory disclosure](https://junglewise.ai/threats/cve-2026-27300-adobe-framemaker-uninitialized-pointer-access-memory-disclosure)
- [Adobe FrameMaker improper input validation in file parsing](https://junglewise.ai/threats/cve-2026-27299-adobe-framemaker-improper-input-validation-in-file-parsing)
- [Adobe FrameMaker type confusion arbitrary code execution](https://junglewise.ai/threats/cve-2026-27298-adobe-framemaker-type-confusion-arbitrary-code-execution)
- [Adobe FrameMaker integer underflow arbitrary code execution](https://junglewise.ai/threats/cve-2026-27297-adobe-framemaker-integer-underflow-arbitrary-code-execution)