#202020

Adobe Security Bulletin

Last updated on Apr 16, 2026

Security Updates Available for Adobe FrameMaker | APSB26-36

Bulletin ID
Date published
Priority
APSB26-36
April 14, 2026
3
style
grid width 12

Summary

Adobe has released a security update for Adobe FrameMaker. This update addresses critical and important vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product
Version
Platform
Adobe FrameMaker
2022 Release Update 8 and earlier
Windows
style
grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product
Version
Platform
Priority
Availability
Adobe FrameMaker
FrameMaker 2026
Windows
3
Tech note
Adobe FrameMaker
FrameMaker 2022 Update 9
Windows
3
Tech note
style
grid width 12

Vulnerability Details

Vulnerability category
Vulnerability impact
Severity
CVSS base score
CVSS vector
CVE number
Untrusted Search Path (CWE-426)
Arbitrary code execution
Critical
8.6
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2026-27290
Use After Free (CWE-416)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27292
Heap-based Buffer Overflow (CWE-122)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27293
Out-of-bounds Read (CWE-125)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27294
Out-of-bounds Write (CWE-787)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27295
Integer Underflow (Wrap or Wraparound) (CWE-191)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27296
Integer Underflow (Wrap or Wraparound) (CWE-191)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27297
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Arbitrary code execution
Critical
7.8
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2026-27298
Improper Input Validation (CWE-20)
Arbitrary file system read
Important
6.3
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CVE-2026-27299
Access of Uninitialized Pointer (CWE-824)
Memory exposure
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2026-27300
Heap-based Buffer Overflow (CWE-122)
Memory exposure
Important
5.5
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2026-27301

Acknowledgments

Adobe would like to thank the following Initiative for reporting the relevant issues and for working with Adobe to help protect our customers:

  • jony_juice -- CVE-2026-27290
  • Francis Provencher (prl) -- CVE-2026-27292, CVE-2026-27293, CVE-2026-27300, CVE-2026-27301
  • yjdfy -- CVE-2026-27294, CVE-2026-27295, CVE-2026-27296, CVE-2026-27297, CVE-2026-27298
  • Sudhanshu Rajbhar (sudi) -- CVE-2026-27299

NOTE: Adobe has a public bug bounty program. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com

CardTitle
APSB26-36
CardDescription
Priority 3 Security update
CardImage
Adobe
Created
2026-04-14
Tags
caas:content-type/documentation,caas:trust-center/security-bulletin,caas:products/framemaker
PrimaryTag
caas:content-type/article
Details
caas:mnemonics/framemaker
Arbitrary
search: CVE-2026-27290 CVE-2026-27292 CVE-2026-27293 CVE-2026-27294 CVE-2026-27295 CVE-2026-27296 CVE-2026-27297 CVE-2026-27298 CVE-2026-27299 CVE-2026-27300 CVE-2026-27301