CVE-2026-27294 is an out-of-bounds read vulnerability in Adobe Framemaker (versions 2022.8 and earlier) triggered by parsing a crafted file. This memory safety issue can cause the application to read past the end of an allocated memory structure, which may be leveraged by an attacker to execute arbitrary code under the context of the current user. Exploitation requires that the victim opens a malicious file, indicating user interaction is necessary. The vulnerability has a CVSS 3.1 base score of 7.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by Adobe as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment. The vulnerability affects confidentiality, integrity, and availability of the affected system. However, exploitation requires user interaction (opening a malicious file). There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when opening files from untrusted sources. No official remediation or temporary fix has been provided by Adobe at this time.