CVE-2026-27293Disclosure(adobe / framemaker)

LOWCVSS 7.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch adobe framemaker systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

adobe CVEs Back to dashboard

1.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://helpx.adobe.com/security/products/framemaker/apsb26-36.html

Weakness type (CWE)

CWE-122

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

framemaker
windows

Threat summary

Patch or workaround signal is available
7 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 4 signals
Technical details provided in 7 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 3 mentions (2026-04-15); latest day: 1
7 total mentions across 4 days

Affected systems

Vendors

adobe microsoft

Products

framemakerwindows

1 version affected across 2 products

Deep dive

Activity timeline7 mentions / 4d

Signal classification3 categories

Disclosure

457.1%

Patch

228.6%

General

114.3%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-14	2	Disclosure1General1
2026-04-15	3	Disclosure3
2026-04-23	1	Patch1
2026-07-31	1	Patch1

Full discourse7 posts

にゃん☆たく/takumi.a@taku888infinity176d
General
ぱっちちゅーずでー ◆ Microsoft 2026 年 4 月のセキュリティ更新プログラム (月例) https://www.microsoft.com/en-us/msrc/blog/2026/04/202604-security-update CVE-2026-33825 Microsoft Defender の特権の昇格の脆弱性 CVE-2026-32201 Microsoft SharePoint Server のなりすましの脆弱性 ◆Fortinet https://fortiguard.fortinet.com/psirt ・FG-IR-26-100 / CVE-2026-39808 FortiSandbox 4.4系のAPIにある OSコマンドインジェクション。細工したリクエストを受けると、認証なしで任意コードや任意コマンドを実行される恐れがあります。外部公開や到達可能性がある環境では、優先度高めでの確認が必要です。・FG-IR-26-112 / CVE-2026-39813 FortiSandbox のJRPC APIにあるパストラバーサル起因の認証回避・権限昇格。特別に細工したHTTPリクエストで未認証のまま認証をバイパスし、権限を引き上げられる可能性があるため、管理API露出環境では特に注意が必要です。・FG-IR-26-121 / CVE-2026-22828 FortiAnalyzer Cloud / FortiManager Cloud の oftpd にあるヒープベースのバッファオーバーフロー。細工したリクエストにより、リモートの未認証攻撃者が任意コードやコマンド実行に至る可能性がありますが、悪用にはASLRや分離構成を踏まえた準備が必要です。 ◆Ivanti https://www.ivanti.com/blog/april-2026-security-update https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-CVE-2026-4913-CVE-2026-4… ◆Adobe（Criticalで任意のコード実行のみ抽出） https://helpx.adobe.com/security.html ・Adobe ColdFusion（APSB26-38） CVE-2026-27304, CVE-2026-27306 入力検証不備により、任意のコード実行につながる脆弱性・Adobe Connect（APSB26-37） CVE: CVE-2026-27302, CVE-2026-27303, CVE-2026-27243, CVE-2026-27245, CVE-2026-27246, CVE-2026-34615 デシリアライズ不備や XSS を起点に、任意のコード実行が可能となる脆弱性・Adobe FrameMaker（APSB26-36） CVE: CVE-2026-27290, CVE-2026-27292, CVE-2026-27293, CVE-2026-27294, CVE-2026-27295, CVE-2026-27296, CVE-2026-27297, CVE-2026-27298 任意のコード実行につながる脆弱性群・Adobe Bridge（APSB26-39） CVE: CVE-2026-34630, CVE-2026-27310, CVE-2026-27311, CVE-2026-27312, CVE-2026-27313 複数のヒープベース・バッファオーバーフローにより、任意のコード実行が可能になる脆弱性・Adobe Photoshop（APSB26-40） CVE: CVE-2026-27289 境界外読み取りにより、任意のコード実行につながる脆弱性・Adobe Illustrator（APSB26-42） CVE: CVE-2026-34618 境界外書き込みにより、任意のコード実行につながる脆弱性 ◆SAP SAP Security Patch Day - April 2026 https://support.sap.com/en/my-support/knowledge-base/security-notes-news/april-2026.html CVE-2026-27681 https://www.cve.org/CVERecord?id=CVE-2026-27681 『（直訳）SAP Business Planning and ConsolidationおよびSAP Business Warehouseにおける認証チェックの不備により、認証済みのユーザーが細工されたSQL文を実行してデータベースデータを読み取り、変更、削除できる脆弱性が存在します。これは、システムの機密性、完全性、可用性に重大な影響を及ぼします。』
Post summary
The post provides a roundup of April 2026 vendor security updates, highlighting multiple CVEs and referencing patch URLs, but contains no PoC, exploit code, or reports of active exploitation.
000321.4K
11.7K followersView on X
DFIR Lab@DFIR_Lab69d
Patch
🚨 HIGH severity CVE-2026-27293 (CVSS 7.8) Adobe FrameMaker ≤2022.8 heap-based buffer overflow enables arbitrary code execution via malicious file. User interaction required. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/60OZg2kfGN
Post summary
Adobe FrameMaker 2022.8 and earlier are vulnerable to a heap-based buffer overflow (CVE-2026-27293). A patch is urgently required to prevent arbitrary code execution.
0000049
99 followersView on X
Giuseppe Paternicola@giuseppe_1337168d
Patch
🚨 HIGH severity CVE-2026-27293 (CVSS 7.8) Adobe FrameMaker ≤2022.8 heap-based buffer overflow enables arbitrary code execution via malicious file. User interaction required. Patch immediately. #CVE #PatchNow #ThreatIntel https://t.co/NxCNy9mYht
Post summary
The tweet warns of a high‑severity CVE-2026‑27293 heap‑based buffer overflow in Adobe FrameMaker that can lead to arbitrary code execution, and urges users to apply the patch immediately.
0000059
26 followersView on X
dbugs@ptdbugs176d
Disclosure
Adobe Framemaker | Heap-based Buffer Overflow (CWE-122) CVE: CVE-2026-27293 PT ID: PT-2026-32942 Vendor: Adobe Product: Adobe Framemaker CVSS: 7.8 Credits: n/a Description: Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. References: • https://dbugs.ptsecurity.com/vulnerability/CVE-2026-27293 • https://helpx.adobe.com/security/products/framemaker/apsb26-36.html #dbugs_vuln
Post summary
Adobe Framemaker Heap-based Buffer Overflow (CVE-2026-27293) has been disclosed with technical details and a vendor advisory, but no PoC, exploit code, or evidence of active exploitation.
0000050
797 followersView on X
CVE@CVEnew176d
Disclosure
CVE-2026-27293 Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context o… https://www.cve.org/CVERecord?id=CVE-2026-27293
Post summary
The text announces a heap-based buffer overflow vulnerability in Adobe Framemaker, noting potential for arbitrary code execution but providing no proof of concept, exploit, patch, or active exploitation evidence.
0000066
57.2K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds176d
Disclosure
CVE-2026-27293 Heap-Based Buffer Overflow in Adobe FrameMaker 2022.8 and Earlier https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27293 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The brief notice announces a heap-based buffer overflow (CVE-2026-27293) affecting Adobe FrameMaker, without providing exploit details, mitigation, or evidence of active exploitation.
0000036
4.0K followersView on X
Kaitan ID Security@KaitanSecurity176d
Disclosure
⚠️ HIGH — CVE-2026-27293 Adobe Framemaker versions 2022.8 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could resu… CVSS 7.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-27293 #Adobe #CyberSecurity #InfoSec
Post summary
A new heap‑based buffer overflow vulnerability (CVE‑2026‑27293) affects Adobe Framemaker 2022.8 and earlier, rated CVSS 7.8, with a link to a full analysis but no exploit, PoC, or patch information reported.
000000
144 followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	adobe	framemaker	-	-	-
OS	microsoft	windows	-	-	-

Explore more

Back to dashboard adobe CVEs microsoft CVEs framemaker vulnerabilities

What researchers are saying

CVE-2026-27293

にゃん☆たく/takumi.a[verified]@taku888infinityGeneral

The post provides a roundup of April 2026 vendor security updates, highlighting multiple CVEs and referencing patch URLs, but contains no PoC, exploit code, or reports of active exploitation.

DFIR Lab[verified]@DFIR_LabPatch

Adobe FrameMaker 2022.8 and earlier are vulnerable to a heap-based buffer overflow (CVE-2026-27293). A patch is urgently required to prevent arbitrary code execution.

Giuseppe Paternicola[verified]@giuseppe_1337Patch

The tweet warns of a high‑severity CVE-2026‑27293 heap‑based buffer overflow in Adobe FrameMaker that can lead to arbitrary code execution, and urges users to apply the patch immediately.

dbugs[verified]@ptdbugsDisclosure

Adobe Framemaker Heap-based Buffer Overflow (CVE-2026-27293) has been disclosed with technical details and a vendor advisory, but no PoC, exploit code, or evidence of active exploitation.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

A new heap‑based buffer overflow vulnerability (CVE‑2026‑27293) affects Adobe Framemaker 2022.8 and earlier, rated CVSS 7.8, with a link to a full analysis but no exploit, PoC, or patch information reported.

CVE@CVEnewDisclosure

The text announces a heap-based buffer overflow vulnerability in Adobe Framemaker, noting potential for arbitrary code execution but providing no proof of concept, exploit, patch, or active exploitation evidence.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The brief notice announces a heap-based buffer overflow (CVE-2026-27293) affecting Adobe FrameMaker, without providing exploit details, mitigation, or evidence of active exploitation.