CVE-2025-47128 Overview
CVE-2025-47128 is an integer underflow vulnerability [CWE-191] affecting Adobe FrameMaker versions 2020.8, 2022.6, and earlier on Microsoft Windows. The flaw can lead to arbitrary code execution in the context of the current user when a victim opens a crafted file. Exploitation requires user interaction, limiting opportunistic attacks but enabling targeted phishing and social engineering campaigns against documentation teams.
Adobe published advisory APSB25-66 to address this issue. No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
Successful exploitation allows arbitrary code execution at the privilege level of the user running Adobe FrameMaker, enabling full compromise of the user's session and data.
Affected Products
- Adobe FrameMaker 2020.8 and earlier 2020.x releases
- Adobe FrameMaker 2022.6 and earlier 2022.x releases
- Microsoft Windows installations running the affected FrameMaker versions
Discovery Timeline
- 2025-07-08 - CVE-2025-47128 published to NVD
- 2025-07-10 - Last updated in NVD database
Technical Details for CVE-2025-47128
Vulnerability Analysis
The vulnerability is classified as an Integer Underflow (Wrap or Wraparound) condition [CWE-191] within Adobe FrameMaker's file parsing logic. An integer underflow occurs when an arithmetic operation produces a value below the minimum representable integer, wrapping around to a large positive value. When this wrapped value is subsequently used for buffer sizing, indexing, or loop control, it corrupts memory management decisions inside the application.
In FrameMaker, the underflow is triggered when the application parses a malicious document. The miscalculated size value drives downstream operations such as memory allocation or copy lengths, resulting in memory corruption. Attackers chain this corruption into control-flow hijacking to execute arbitrary code in the FrameMaker process.
The issue is local in scope and requires the user to open a specially crafted file. Code executes with the privileges of the logged-in user, providing a foothold for subsequent privilege escalation, credential theft, or lateral movement.
Root Cause
The root cause is unchecked or insufficiently validated arithmetic on values derived from untrusted file input. A subtraction against an attacker-controlled field produces a negative result that wraps to a large unsigned value, defeating subsequent bounds checks.
Attack Vector
The attack vector is local file delivery. Attackers distribute a malicious FrameMaker document through phishing email, shared drives, or compromised collaboration platforms. When a targeted user opens the file in a vulnerable FrameMaker build, the parser triggers the underflow and executes attacker-supplied shellcode.
No verified proof-of-concept exploit is publicly available. Refer to the Adobe Security Advisory APSB25-66 for vendor technical details.
Detection Methods for CVE-2025-47128
Indicators of Compromise
- Unexpected child processes spawned by FrameMaker.exe, such as cmd.exe, powershell.exe, or rundll32.exe.
- FrameMaker process crashes with access violation exceptions logged in the Windows Application event log.
- FrameMaker writing executable files or scripts to user-writable directories such as %APPDATA% or %TEMP%.
- Outbound network connections originating from FrameMaker.exe to unfamiliar external hosts.
Detection Strategies
- Monitor process lineage for FrameMaker spawning interpreters, scripting hosts, or LOLBins inconsistent with normal authoring activity.
- Hunt for FrameMaker file opens followed by suspicious file creation, registry modification, or persistence artifacts within a short time window.
- Apply YARA or content rules against FrameMaker file formats (.fm, .book, .mif) staged in mail gateways and file shares.
Monitoring Recommendations
- Enable Windows Defender Exploit Guard or equivalent attack surface reduction rules to block Office and document applications from creating child processes.
- Forward Sysmon process creation, image load, and file create events from authoring workstations to a centralized SIEM for correlation.
- Alert on FrameMaker module loads from non-standard directories or unsigned binaries injected into the process.
How to Mitigate CVE-2025-47128
Immediate Actions Required
- Inventory all systems running Adobe FrameMaker 2020.x or 2022.x and prioritize patching for documentation, technical writing, and publishing teams.
- Update Adobe FrameMaker to the fixed versions identified in Adobe Security Advisory APSB25-66.
- Instruct users to avoid opening FrameMaker documents received from untrusted or unverified senders until patches are deployed.
- Block inbound .fm, .book, and .mif attachments at the mail gateway pending remediation.
Patch Information
Adobe released fixed builds through advisory APSB25-66. Administrators should deploy the vendor-supplied updates to all FrameMaker installations on Windows. Review the Adobe Security Advisory APSB25-66 for the exact patched version numbers and download links.
Workarounds
- Restrict FrameMaker usage to a dedicated, segmented workstation group with limited network access until patches are validated.
- Run FrameMaker under a standard user account rather than a privileged account to reduce post-exploitation impact.
- Deploy application allowlisting to prevent FrameMaker from launching scripting interpreters or unsigned executables.
# Configuration example: query installed Adobe FrameMaker version on Windows endpoints
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
Where-Object { $_.DisplayName -like "*FrameMaker*" } |
Select-Object DisplayName, DisplayVersion, InstallLocation
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
