CVE-2025-47120: Adobe FrameMaker Buffer Overflow Vulnerability

CVE-2025-47120 Overview

Adobe Framemaker versions 2020.8, 2022.6, and earlier contain a stack-based buffer overflow vulnerability [CWE-121]. The flaw allows an attacker to disclose sensitive memory contents when a victim opens a crafted file. Exploitation requires local access and user interaction, since the target must open the malicious document in Framemaker.

Adobe published fixes in security advisory APSB25-66 on July 8, 2025. The vulnerability affects Adobe Framemaker installations running on Microsoft Windows.

Critical Impact
Successful exploitation exposes sensitive process memory contents, which attackers can use to bypass memory protections such as Address Space Layout Randomization (ASLR) or extract secrets from the Framemaker process.

Affected Products

Adobe Framemaker 2020.8 and earlier
Adobe Framemaker 2022.6 and earlier
Microsoft Windows (host platform)

Discovery Timeline

2025-07-08 - Adobe publishes security advisory APSB25-66
2025-07-08 - CVE-2025-47120 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47120

Vulnerability Analysis

The vulnerability is a stack-based buffer overflow [CWE-121] in Adobe Framemaker's file parsing logic. When Framemaker processes a malformed document, the parser writes attacker-controlled data beyond the fixed bounds of a stack buffer. The overflow does not corrupt execution flow into arbitrary code in this case. Instead, it results in disclosure of adjacent stack memory contents to the attacker.

Memory disclosure vulnerabilities in document parsers are commonly used to leak pointers, stack canaries, or module base addresses. Attackers frequently chain such leaks with separate memory corruption flaws to defeat exploit mitigations. The attack surface is limited to users who open untrusted .fm, .mif, or other Framemaker-supported file types.

Root Cause

The root cause is missing or incorrect bounds validation when Framemaker copies data from a parsed file structure into a fixed-size stack allocation. Length or offset fields inside the malicious document exceed the destination buffer size, and the copy routine reads or writes past the buffer boundary. Adobe has not published detailed technical analysis of the specific parser routine involved.

Attack Vector

An attacker crafts a malicious Framemaker document and delivers it through email, file share, download, or another user-initiated channel. The victim opens the file in a vulnerable Framemaker build on Windows. Parsing triggers the overflow, and the process returns memory contents that the attacker can retrieve through document behavior, error output, or a paired secondary vulnerability. The attacker cannot exploit this remotely without user interaction.

See the Adobe Security Advisory APSB25-66 for vendor-supplied technical detail.

Detection Methods for CVE-2025-47120

Indicators of Compromise

Unexpected crashes or Windows Error Reporting (WER) entries for FrameMaker.exe following the open of a document from an untrusted source.
Framemaker document files (.fm, .mif, .book) received from external senders or downloaded from unverified web locations.
Child processes spawned by FrameMaker.exe that deviate from normal application behavior.

Detection Strategies

Inventory endpoints running Adobe Framemaker and identify installations at or below versions 2020.8 and 2022.6.
Alert on Framemaker document files delivered through email gateways or downloaded from external domains.
Correlate Framemaker process crashes with recent file-open events to identify potential exploitation attempts.

Monitoring Recommendations

Collect Windows application and WER logs from workstations with Framemaker installed and forward them to a central log platform.
Monitor process creation events (Sysmon Event ID 1) where the parent process is FrameMaker.exe.
Track file write and read activity by FrameMaker.exe in user download and temp directories for post-exploitation artifacts.

How to Mitigate CVE-2025-47120

Immediate Actions Required

Upgrade Adobe Framemaker to the patched versions listed in APSB25-66 on all Windows endpoints.
Identify and remove unsupported Framemaker installations that no longer receive vendor updates.
Instruct users to avoid opening Framemaker documents received from untrusted sources until patching completes.

Patch Information

Adobe released fixed builds on July 8, 2025 in security advisory APSB25-66. Administrators should review the advisory for the specific patched version numbers and download the updated installers. See the Adobe Security Advisory APSB25-66 for full patch details.

Workarounds

Restrict Framemaker document handling to trusted internal file shares while patching is in progress.
Apply email attachment filtering rules that block or quarantine Framemaker file extensions from external senders.
Enforce application allowlisting to prevent unauthorized Framemaker versions from executing on managed endpoints.

bash

# Example: query installed Adobe Framemaker version on Windows endpoints via PowerShell
Get-ItemProperty 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*' |
  Where-Object { $_.DisplayName -like 'Adobe FrameMaker*' } |
  Select-Object DisplayName, DisplayVersion, InstallDate