Product:
Adobe Framemaker
Summary
Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. An attacker could modify the search path to point to a malicious program, which the application would then execute. Exploitation does not require user interaction.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.6 | CVE-2026-27290 |
Exploitation
To exploit this vulnerability, an attacker must manipulate the search path used by Adobe Framemaker to locate critical resources. By placing a malicious program in a location that is prioritized in the search path, the attacker can ensure that the application executes this program instead of the legitimate one. This can be done without any user interaction, making it a significant risk.
Affected Products
- Adobe Framemaker 2022.8 and earlier: Vulnerable to arbitrary code execution due to an untrusted search path.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of Adobe Framemaker. Additionally, it is recommended to review and secure the search paths used by the application to prevent unauthorized modifications. Regularly updating software and monitoring for suspicious activity can also help reduce the risk.