CVE-2025-47130: Adobe FrameMaker RCE Vulnerability

CVE-2025-47130 Overview

CVE-2025-47130 is an integer underflow vulnerability [CWE-191] affecting Adobe Framemaker versions 2020.8, 2022.6, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published the advisory APSB25-66 on July 8, 2025.

The vulnerability requires user interaction and local access. An attacker must deliver a crafted Framemaker document and convince the user to open it. Successful exploitation grants code execution at the privilege level of the logged-in user.

Critical Impact
Arbitrary code execution in the user's context on Windows systems running vulnerable Adobe Framemaker releases, with high confidentiality, integrity, and availability impact.

Affected Products

Adobe Framemaker 2020.8 and earlier 2020-branch releases
Adobe Framemaker 2022.6 and earlier 2022-branch releases
Microsoft Windows hosts running affected Framemaker versions

Discovery Timeline

2025-07-08 - CVE-2025-47130 published to NVD and Adobe advisory APSB25-66 released
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2025-47130

Vulnerability Analysis

The vulnerability is classified as an Integer Underflow (Wrap or Wraparound) condition [CWE-191]. Integer underflows occur when an arithmetic operation produces a value lower than the minimum representable value for its data type. The result wraps around to a large positive number when interpreted as unsigned.

In parsing logic, such wrap-arounds typically subvert size checks. A length field that should be small becomes very large after subtraction, causing downstream memory operations to copy or read far beyond intended boundaries. Adobe states the outcome is arbitrary code execution in the context of the current user.

The attack vector is local with user interaction required. A victim must open a malicious Framemaker file delivered through email, web download, or removable media. No elevated privileges are needed for the attacker to craft the file.

Root Cause

The root cause is improper validation of a numeric value during file parsing within Adobe Framemaker. When the value underflows, subsequent allocation or bounds-check logic operates on a corrupted size, enabling memory corruption that the attacker can steer toward control-flow hijacking. Adobe has not published technical specifics in the public advisory.

Attack Vector

Exploitation follows a standard client-side document attack pattern. The attacker constructs a malformed .fm or related Framemaker file containing the trigger value. Delivery occurs through phishing, watering-hole sites, or file-sharing channels. Code executes when the user opens the file in a vulnerable Framemaker build.

No verified proof-of-concept code is publicly available for CVE-2025-47130.
Refer to Adobe Security Advisory APSB25-66 for vendor guidance.

Detection Methods for CVE-2025-47130

Indicators of Compromise

Unexpected child processes spawned by FrameMaker.exe, such as cmd.exe, powershell.exe, or rundll32.exe
Framemaker process writing executable files to user-writable paths including %TEMP%, %APPDATA%, or %LOCALAPPDATA%
Outbound network connections originating from FrameMaker.exe to untrusted hosts shortly after a document open event
Crash events or Windows Error Reporting entries referencing FrameMaker.exe and access violations

Detection Strategies

Hunt for process-creation telemetry where FrameMaker.exe is the parent of a shell, scripting interpreter, or LOLBAS binary
Alert on Framemaker files arriving from external email or browser downloads that are opened within minutes of receipt
Correlate Framemaker crashes with subsequent persistence creation in Run keys or scheduled tasks

Monitoring Recommendations

Enable Microsoft Defender Attack Surface Reduction rules that block Office and document apps from creating child processes where compatible
Collect Sysmon Event IDs 1, 7, and 11 from endpoints running Framemaker for process, image-load, and file-creation visibility
Behavioral AI engines such as Singularity Endpoint identify post-exploitation activity by analyzing anomalous process behavior originating from document applications

How to Mitigate CVE-2025-47130

Immediate Actions Required

Upgrade Adobe Framemaker to the fixed releases identified in APSB25-66 on every Windows host
Inventory endpoints for installed Framemaker versions and prioritize systems used by users who routinely process external documents
Treat unsolicited Framemaker files the same as macro-enabled Office documents and quarantine them at the email gateway

Patch Information

Adobe released fixed builds alongside the Adobe Security Advisory APSB25-66 on July 8, 2025. Customers running Framemaker 2020.8, 2022.6, or earlier must update to the patched versions referenced in the advisory. No vendor-supported workaround is documented.

Workarounds

Restrict opening of Framemaker files to documents from trusted internal sources until patching completes
Apply application allowlisting to prevent FrameMaker.exe from launching child processes such as cmd.exe and powershell.exe
Enforce least-privilege user accounts so that code execution from a malicious file cannot escalate to administrative actions

bash

# Query installed Framemaker version on Windows endpoints
reg query "HKLM\SOFTWARE\Adobe\FrameMaker" /s /v Version

# Example WDAC / AppLocker rule concept: block FrameMaker child processes
# Deny: Parent=FrameMaker.exe -> Child in {cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe}