CVE-2026-27296
Integer Underflow in Adobe FrameMaker Allows Code Execution
Publication date: 2026-04-14
Last updated on: 2026-04-15
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | framemaker | to 2022.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Integer Underflow (also known as Wrap or Wraparound) found in Adobe Framemaker versions 2022.8 and earlier. It occurs when a numeric value is decreased below its minimum limit, causing unexpected behavior in the software.
Exploitation requires user interaction, meaning a victim must open a specially crafted malicious file to trigger the vulnerability.
If successfully exploited, it could allow an attacker to execute arbitrary code with the privileges of the current user.
How can this vulnerability impact me? :
This vulnerability can lead to arbitrary code execution in the context of the current user, which means an attacker could potentially run malicious code on your system.
The impact includes full compromise of the affected user's data and system capabilities, depending on the user's privileges.
Since exploitation requires opening a malicious file, social engineering or phishing could be used to trick users into triggering the attack.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid opening files from untrusted or unknown sources in Adobe Framemaker versions 2022.8 and earlier, as exploitation requires user interaction by opening a malicious file.
Additionally, consider updating Adobe Framemaker to a version later than 2022.8 once a patch is available to address this Integer Underflow vulnerability.