CVE-2026-27299 is an improper input validation vulnerability (CWE-20) in Adobe Framemaker up to version 2022.8. This flaw enables an attacker to cause the application to read arbitrary files from the file system, potentially exposing sensitive data. Exploitation requires the victim to open a crafted malicious file, which triggers the vulnerability. The CVSS vector indicates local attack vector with low complexity, no privileges required, user interaction needed, and scope changed. The vulnerability affects confidentiality but not integrity or availability.

Successful exploitation can lead to unauthorized disclosure of sensitive files on the affected system. There is no impact on system integrity or availability. The attack requires user interaction, limiting the attack surface to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources and consider restricting access to Adobe Framemaker to trusted users only.