CVE-2025-30300: Adobe FrameMaker NULL Pointer DOS Vulnerability

CVE-2025-30300 Overview

CVE-2025-30300 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe Framemaker versions 2020.8, 2022.6, and earlier. An attacker can craft a malicious file that, when opened by a victim, triggers the flaw and crashes the application. Successful exploitation produces a denial-of-service condition on the affected host. The issue requires local access and user interaction, and it does not affect confidentiality or integrity. Adobe addressed the vulnerability in security bulletin APSB25-33.

Critical Impact
A crafted document opened in Adobe Framemaker crashes the application, disrupting document authoring and publishing workflows on affected Windows systems.

Affected Products

Adobe Framemaker 2020 (through 2020.8)
Adobe Framemaker 2022 (through 2022.6)
Microsoft Windows platforms running the affected Framemaker builds

Discovery Timeline

2025-04-08 - CVE-2025-30300 published to NVD
2025-04-08 - Adobe releases security bulletin APSB25-33 with fixed versions
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30300

Vulnerability Analysis

The vulnerability is a NULL pointer dereference [CWE-476] in Adobe Framemaker's file parsing logic. When Framemaker processes a specially crafted document, code paths dereference a pointer that was never assigned a valid address. The resulting access violation terminates the application process. The impact is limited to availability; no memory disclosure, code execution, or privilege escalation has been reported for this issue. Because Framemaker is a desktop authoring tool, the practical effect is loss of unsaved work and interruption of documentation pipelines.

Root Cause

The root cause is missing validation of a pointer returned by an internal object or parser routine before it is dereferenced. Malformed structures inside a Framemaker-compatible file cause the parser to reach an unexpected state where a required object is not instantiated. Subsequent code accesses fields on that NULL reference and triggers the crash.

Attack Vector

Exploitation requires local access and user interaction. An attacker delivers a malicious Framemaker file through email, a shared drive, a download, or a collaboration platform. When the victim opens the file in a vulnerable Framemaker build, the application crashes. The attack cannot be executed remotely without user cooperation and cannot escalate beyond a denial-of-service outcome.

No public proof-of-concept or in-the-wild exploitation has been documented. See the Adobe Security Bulletin APSB25-33 for vendor-supplied technical context.

Detection Methods for CVE-2025-30300

Indicators of Compromise

Repeated FrameMaker.exe process crashes recorded in the Windows Application event log with faulting module entries.
Windows Error Reporting (WER) artifacts referencing Framemaker under %LOCALAPPDATA%\Microsoft\Windows\WER\ReportQueue.
Unexpected Framemaker document files (.fm, .book, .mif) arriving via email or external file shares from untrusted senders.

Detection Strategies

Monitor endpoint telemetry for abnormal termination of FrameMaker.exe shortly after a document open event.
Alert on Framemaker file types delivered through email gateways or web downloads from unverified sources.
Correlate document open events with subsequent process exit codes indicating access violations (0xC0000005).

Monitoring Recommendations

Ingest Windows Application and WER logs into a centralized log platform to surface recurring Framemaker crashes across users.
Track Framemaker version inventory using software asset management to identify hosts still running 2020.8 or 2022.6 and earlier.
Review mail and web proxy logs for inbound Framemaker file formats from external domains.

How to Mitigate CVE-2025-30300

Immediate Actions Required

Upgrade Adobe Framemaker to the fixed versions listed in Adobe Security Bulletin APSB25-33.
Instruct users to avoid opening Framemaker files received from untrusted or unverified sources until patches are applied.
Inventory all endpoints running Framemaker 2020 or 2022 and prioritize patching for documentation and publishing teams.

Patch Information

Adobe released fixed builds of Framemaker 2020 and 2022 in security bulletin APSB25-33. Administrators should apply the vendor-supplied updates through the standard Framemaker update mechanism or by downloading the current installer from Adobe. Confirm the installed build number after patching to verify remediation.

Workarounds

Restrict opening Framemaker documents to files from known internal authors and validated repositories.
Enforce email attachment filtering for Framemaker file extensions (.fm, .book, .mif) originating outside the organization.
Encourage frequent saving and enable auto-save so an application crash does not result in significant data loss.

bash

# Query installed Adobe Framemaker version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe FrameMaker*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate