CVE-2026-27298 is a type confusion vulnerability in Adobe Framemaker (versions 2022.8 and earlier) that could lead to arbitrary code execution in the context of the current user. The issue arises from accessing a resource using an incompatible type, which can be triggered when a user opens a crafted malicious file. The vulnerability requires user interaction and has a CVSS 3.1 base score of 7.8, indicating high severity. No patch or official remediation level has been disclosed by Adobe as of the publication date.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment. The attack requires user interaction, limiting remote exploitation to scenarios where the victim opens a malicious file. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should exercise caution when opening files from untrusted sources and consider restricting usage of Adobe Framemaker to trusted documents only.