Executive brief
Adobe FrameMaker, a professional document authoring and publishing solution, is vulnerable to a security flaw that could allow an attacker to run unauthorized software on a user's computer. By placing a malicious file in a specific location that the application searches, an attacker can trick FrameMaker into executing their code. This could lead to a full system compromise, data theft, or unauthorized access to sensitive corporate documents.
Technical details
Adobe FrameMaker is vulnerable to an Untrusted Search Path (CWE-426) flaw in versions 2022.8 and earlier. The application incorrectly handles the search path used to locate and load critical resources or external libraries. A local attacker can exploit this by placing a malicious executable or DLL in a directory that precedes the legitimate resource in the search order. When the application attempts to load the resource, it executes the attacker's code instead, running with the privileges of the current user. While the CVSS vector indicates user interaction (UI:R) is typically required for local path redirection, the advisory notes that exploitation of this specific issue may not require direct user interaction once the malicious file is staged.
Affected products
- Adobe FrameMaker 2022.8 and earlier
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory