CVE-2026-103966: Heap-based Buffer Overflow (CWE-122) in Adobe Adobe FrameMaker 2026

CVE-2026-103966 is a heap-based buffer overflow vulnerability (CWE-122) in Adobe FrameMaker 2026. Successful exploitation allows an attacker to execute arbitrary code in the context of the current user. The attack vector requires user interaction, specifically opening a malicious file. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity with local attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. However, exploitation requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening files from untrusted sources in Adobe FrameMaker 2026.