CVE-2026-27294 is an out-of-bounds read vulnerability (CWE-125) in Adobe Framemaker 2022.8 and earlier. When processing a specially crafted file, the software may read memory beyond the allocated buffer, which can be leveraged by an attacker to execute arbitrary code in the context of the current user. Exploitation requires that the victim opens a malicious file, indicating user interaction is necessary. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Adobe as of the data provided.

Successful exploitation could result in arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. Since user interaction is required, the attack vector is local or via social engineering. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources and consider restricting usage of Adobe Framemaker to trusted documents only.