CVE-2025-47119: Adobe FrameMaker NULL Pointer DOS Vulnerability

CVE-2025-47119 Overview

CVE-2025-47119 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe Framemaker versions 2020.8, 2022.6, and earlier. An attacker can craft a malicious file that, when opened by a victim, causes the application to dereference an invalid pointer and crash. The impact is limited to application denial-of-service on the local host. Exploitation requires user interaction, as the victim must open the attacker-supplied file. Adobe published the fix in security bulletin APSB25-66.

Critical Impact
Successful exploitation crashes Adobe Framemaker on the affected workstation, disrupting document authoring workflows until the application is restarted.

Affected Products

Adobe Framemaker 2020.8 and earlier 2020.x releases
Adobe Framemaker 2022.6 and earlier 2022.x releases
Microsoft Windows hosts running the affected Framemaker versions

Discovery Timeline

2025-07-08 - CVE-2025-47119 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47119

Vulnerability Analysis

The issue is a NULL pointer dereference in Adobe Framemaker's file parsing logic. When Framemaker processes a specially crafted document, code paths in the parser reach a pointer that has not been initialized or that was set to NULL after a failed allocation or lookup. Dereferencing this pointer triggers an access violation, and Windows terminates the process. The defect maps to [CWE-476: NULL Pointer Dereference]. Because the vulnerability affects only availability, confidentiality and integrity of user data remain intact. However, unsaved changes in the open document may be lost when the application crashes.

Root Cause

The root cause is missing validation of a pointer before it is dereferenced during file parsing. The parser assumes an object or structure is present after a preceding step, but under attacker-controlled input the referenced object is never created. No bounds check or null guard exists on the code path, so execution reaches an instruction that reads from address 0x00000000 and faults.

Attack Vector

Exploitation is local and requires user interaction. An attacker delivers a malicious Framemaker document through email, a shared drive, a collaboration platform, or a web download. When the victim opens the file in a vulnerable version of Framemaker on Windows, the parser crashes the process. The vulnerability cannot be triggered remotely without user action and does not yield code execution or privilege escalation. Public exploit code is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code has been published. Refer to the Adobe Security Patch APSB25-66 for vendor technical details.

Detection Methods for CVE-2025-47119

Indicators of Compromise

Unexpected termination of the FrameMaker.exe process shortly after a user opens a document
Windows Application event log entries showing an access violation (0xC0000005) in FrameMaker.exe with a fault offset in file-parsing modules
Windows Error Reporting (WerFault.exe) crash dumps generated for Framemaker following receipt of an external document

Detection Strategies

Correlate Framemaker crash events with the recent opening of documents originating from email attachments, external file shares, or downloaded archives
Alert on repeated Framemaker process crashes on the same endpoint within a short time window, which may indicate iterative exploitation attempts
Inspect email and web proxy telemetry for .fm, .book, .mif, and related Framemaker file types delivered from untrusted senders

Monitoring Recommendations

Forward Windows Application and Security event logs to a central SIEM and build detections for FrameMaker.exe crash signatures
Track the installed Framemaker version across managed workstations and flag hosts still running 2020.8, 2022.6, or earlier builds
Monitor file-write events that place Framemaker document types into user Downloads, Desktop, and Temp directories from external sources

How to Mitigate CVE-2025-47119

Immediate Actions Required

Apply the Adobe security update referenced in APSB25-66 to all Windows workstations running Adobe Framemaker
Inventory endpoints for vulnerable Framemaker builds and prioritize patch deployment for users who routinely open externally sourced documents
Instruct Framemaker users to save work frequently and to avoid opening unsolicited .fm, .book, or .mif files

Patch Information

Adobe addressed the vulnerability in the updates documented in Adobe Security Patch APSB25-66. Upgrade Framemaker to the fixed release listed in the bulletin for both the 2020 and 2022 product lines.

Workarounds

Restrict Framemaker document types at the email gateway and web proxy from untrusted senders until patching is complete
Open documents from unknown sources inside an isolated virtual machine or sandbox rather than on production workstations
Enable Attack Surface Reduction rules and application containment policies that limit the blast radius of a crashing office application

bash

# Query installed Adobe Framemaker version on Windows endpoints
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*FrameMaker*" } |
  Select-Object DisplayName, DisplayVersion, Publisher