CVE-2024-47422: Adobe FrameMaker RCE Vulnerability

CVE-2024-47422 Overview

Adobe Framemaker versions 2020.6, 2022.4 and earlier contain an Untrusted Search Path vulnerability [CWE-426] that can lead to arbitrary code execution. An attacker can place a malicious library or binary in a directory referenced by the application's search path. When Framemaker loads the planted file, it executes attacker-controlled code in the context of the current user. Exploitation requires user interaction, such as opening a file or launching the application from an attacker-influenced location. Successful attacks compromise confidentiality, integrity, and availability on the affected Windows host.

Critical Impact
Local arbitrary code execution in the context of the current user, enabling full compromise of user data and installed applications on the affected workstation.

Affected Products

Adobe Framemaker 2020.6 and earlier 2020.x releases
Adobe Framemaker 2022.4 and earlier 2022.x releases
Microsoft Windows host platforms running the affected Framemaker versions

Discovery Timeline

2024-10-09 - CVE-2024-47422 published to the National Vulnerability Database
2024-10-09 - Adobe publishes Security Advisory APSB24-82 with fixed builds
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47422

Vulnerability Analysis

The flaw is an Untrusted Search Path weakness [CWE-426] in Adobe Framemaker. The application resolves one or more dependencies, such as dynamic-link libraries or helper executables, without pinning them to a trusted absolute path. Windows then walks the standard search order, which includes the current working directory and other locations a low-privileged user can control. If an attacker plants a malicious file with the expected name in one of these locations, Framemaker loads it during normal use. The loaded code runs in-process with the same privileges as the user running Framemaker.

Root Cause

The root cause is insecure library and binary loading. Framemaker relies on the default Windows search order rather than fully qualified paths, SetDefaultDllDirectories, or signed-image validation. This lets untrusted directories participate in dependency resolution.

Attack Vector

Exploitation is local and requires user interaction. A typical scenario involves a user opening a Framemaker project or document from a directory that also contains a malicious DLL with the name of a library Framemaker loads at startup. When the application launches from that directory, Windows loads the attacker's DLL, achieving arbitrary code execution as the current user. Shared network folders, removable media, and browser download directories are common delivery paths.

No public proof-of-concept is listed in the enriched data, and this CVE is not present on the CISA Known Exploited Vulnerabilities catalog. See the Adobe Security Advisory APSB24-82 for vendor technical details.

Detection Methods for CVE-2024-47422

Indicators of Compromise

Unsigned or unexpected DLLs located next to FrameMaker.exe or inside user-writable directories such as Downloads, Temp, or removable media used to open .fm files
Framemaker process (FrameMaker.exe) loading modules from user profile paths rather than C:\Program Files\Adobe\
Child processes such as cmd.exe, powershell.exe, or rundll32.exe spawned by FrameMaker.exe

Detection Strategies

Alert on image loads into FrameMaker.exe where the module path is outside the Adobe install directory and the signer is not Adobe
Correlate document-open activity from network shares or removable drives with subsequent DLL loads from the same directory
Hunt for anomalous parent-child process relationships originating from Framemaker

Monitoring Recommendations

Enable Sysmon Event ID 7 (ImageLoad) with a filter for FrameMaker.exe to capture unsigned or non-Adobe modules
Ingest EDR telemetry for module load, process creation, and file write events involving Framemaker into a central data lake for retrospective hunts
Track user-initiated launches of Framemaker from non-standard directories using command-line auditing

How to Mitigate CVE-2024-47422

Immediate Actions Required

Upgrade Adobe Framemaker 2020 to version 2020.7 or later, and Adobe Framemaker 2022 to version 2022.5 or later, per Adobe APSB24-82
Inventory all workstations running Framemaker and prioritize patching for authors who regularly open documents from shared drives or email
Restrict write permissions on the Framemaker installation directory and any directory used to launch the application

Patch Information

Adobe released fixed builds on 2024-10-08 in Security Bulletin APSB24-82. Refer to the Adobe Security Advisory APSB24-82 for exact build numbers, download links, and priority ratings.

Workarounds

Do not launch Framemaker or open .fm files directly from network shares, removable media, or the Downloads folder until patched
Use AppLocker or Windows Defender Application Control to block execution of unsigned DLLs from user-writable paths
Configure standard user accounts for authoring workflows so that code execution is limited to non-administrative context

bash

# Example AppLocker DLL rule: block unsigned DLLs from user-writable paths
# Run in an elevated PowerShell session
New-AppLockerPolicy -RuleType Path -User Everyone `
  -Action Deny -PathCondition "%OSDRIVE%\Users\*" `
  -RuleNamePrefix "Block-Unsigned-DLL-UserDirs" |
  Set-AppLockerPolicy -Merge