Adobe Security Bulletin

Last updated on Apr 16, 2026

Security Updates Available for Adobe FrameMaker | APSB26-36

Bulletin ID

Date published

Priority

APSB26-36

April 14, 2026

3

style

grid width 12

Summary

Adobe has released a security update for Adobe FrameMaker. This update addresses critical and important vulnerabilities that could lead to arbitrary code execution, arbitrary file system read, and memory exposure.

Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates.

Affected versions

Product

Version

Platform

Adobe FrameMaker

2022 Release Update 8 and earlier

Windows

style

grid width 12

Solution

Adobe categorizes these updates with the following priority ratings and recommends users update their installation to the newest version:

Product

Version

Platform

Priority

Availability

Adobe FrameMaker

FrameMaker 2026

Windows

3

Tech note

Adobe FrameMaker

FrameMaker 2022 Update 9

Windows

3

Tech note

style

grid width 12

Vulnerability Details

CVE-2026-27290

Vulnerability category: Untrusted Search Path (CWE-426)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 8.6
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVE-2026-27292

Vulnerability category: Use After Free (CWE-416)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27293

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27294

Vulnerability category: Out-of-bounds Read (CWE-125)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27295

Vulnerability category: Out-of-bounds Write (CWE-787)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27296

Vulnerability category: Integer Underflow (Wrap or Wraparound) (CWE-191)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27297

Vulnerability category: Integer Underflow (Wrap or Wraparound) (CWE-191)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27298

Vulnerability category: Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Vulnerability impact: Arbitrary code execution
Severity: Critical
CVSS base score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVE-2026-27299

Vulnerability category: Improper Input Validation (CWE-20)
Vulnerability impact: Arbitrary file system read
Severity: Important
CVSS base score: 6.3
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

CVE-2026-27300

Vulnerability category: Access of Uninitialized Pointer (CWE-824)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CVE-2026-27301

Vulnerability category: Heap-based Buffer Overflow (CWE-122)
Vulnerability impact: Memory exposure
Severity: Important
CVSS base score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Acknowledgments

Adobe would like to thank the following Initiative for reporting the relevant issues and for working with Adobe to help protect our customers:

jony_juice -- CVE-2026-27290
Francis Provencher (prl) -- CVE-2026-27292, CVE-2026-27293, CVE-2026-27300, CVE-2026-27301
yjdfy -- CVE-2026-27294, CVE-2026-27295, CVE-2026-27296, CVE-2026-27297, CVE-2026-27298
Sudhanshu Rajbhar (sudi) -- CVE-2026-27299

NOTE: Adobe has a public bug bounty program with Intigriti. If you are interested in working with Adobe as an external security researcher, please check out https://app.intigriti.com/programs/adobe/adobepublic/detail

For more information, visit https://www.adobe.com/trust/security/bug-bounty.html, or email PSIRT@adobe.com

CardTitle

APSB26-36

CardDescription

Priority 3 Security update

CardImage

Created

2026-04-14