CVE-2026-27300
Access of Uninitialized Pointer in Adobe Framemaker Causes Memory Exposure
Publication date: 2026-04-14
Last updated on: 2026-04-15
Assigner: Adobe Systems Incorporated
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| adobe | framemaker | to 2022.9 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-824 | The product accesses or uses a pointer that has not been initialized. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Adobe Framemaker versions 2022.8 and earlier. It is an Access of Uninitialized Pointer issue that could lead to memory exposure. Essentially, an attacker could exploit this flaw to disclose sensitive information from the memory.
Exploitation requires user interaction, meaning the victim must open a malicious file for the attack to succeed.
How can this vulnerability impact me? :
This vulnerability can impact you by potentially exposing sensitive information stored in memory. An attacker who successfully exploits this flaw could gain access to confidential data without authorization.
Since exploitation requires opening a malicious file, users are at risk if they open files from untrusted sources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, ensure that users do not open malicious files in Adobe Framemaker versions 2022.8 and earlier.
Consider updating Adobe Framemaker to a version later than 2022.8 once a patch or fix is available from Adobe.
Educate users about the risks of opening files from untrusted sources to reduce the chance of exploitation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability could lead to memory exposure and the disclosure of sensitive information if exploited. Such unauthorized disclosure of sensitive data may impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information.
However, exploitation requires user interaction, specifically opening a malicious file, which may limit the risk but does not eliminate the potential compliance impact if sensitive data is exposed.