CVE-2026-104340: Heap-based Buffer Overflow (CWE-122) in Adobe Adobe FrameMaker 2026

CVE-2026-104340 is a heap-based buffer overflow vulnerability (CWE-122) in Adobe FrameMaker 2026. This flaw allows an attacker to execute arbitrary code in the context of the current user if the victim opens a specially crafted malicious file. The vulnerability affects versions up to 18.0.0.206 and 17.0.9.866. The CVSS v3.1 base score is 7.8, indicating high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation can result in arbitrary code execution with full control over the affected system under the current user's privileges. This can lead to data compromise, system manipulation, or denial of service. However, exploitation requires user interaction, limiting the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening files from untrusted sources and apply standard security best practices to limit exposure.