CVE-2026-104341: Adobe FrameMaker RCE Vulnerability

CVE-2026-104341 Overview

Adobe FrameMaker contains an out-of-bounds write vulnerability [CWE-787] that allows arbitrary code execution in the context of the current user. An attacker crafts a malicious document and delivers it to a victim through email, file share, or web download. Opening the file triggers the memory corruption and executes attacker-controlled code.

Adobe published advisory APSB26-172 to address the issue. Exploitation requires user interaction, which places this flaw in a common phishing and document-weaponization workflow. No public proof-of-concept or in-the-wild exploitation has been reported at this time.

Critical Impact

Successful exploitation grants arbitrary code execution with the privileges of the user opening the malicious FrameMaker file, enabling full compromise of the user context, credential theft, and lateral movement.

Affected Products

• Adobe FrameMaker (versions identified in Adobe advisory APSB26-172)
• Windows installations of Adobe FrameMaker
• Any workflow processing untrusted FrameMaker-compatible document files

Discovery Timeline

• 2026-10-13 - CVE-2026-104341 published to the National Vulnerability Database
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104341

Vulnerability Analysis

The flaw is an out-of-bounds write condition in Adobe FrameMaker's file parsing logic. FrameMaker processes structured document formats containing size fields, offsets, and embedded objects. When the parser trusts attacker-controlled length or index values, it writes beyond the bounds of an allocated buffer. The resulting memory corruption overwrites adjacent heap metadata, function pointers, or object vtables.

Attackers leverage this primitive to redirect execution flow. Combined with heap grooming and bypasses for Address Space Layout Randomization (ASLR), the write primitive yields reliable arbitrary code execution. The attack runs in the security context of the user who opened the document.

The attack is local because the file must be opened on the target host. Delivery, however, uses network channels such as email attachments or shared storage.

Root Cause

The root cause is an out-of-bounds write classified under [CWE-787]. FrameMaker's parser fails to validate boundary conditions on fields derived from file-supplied data before writing to a destination buffer. See the Adobe Security Update APSB26-172 for component-level detail.

Attack Vector

Exploitation requires a single user action: opening a weaponized FrameMaker file. The attacker crafts the document to trigger the vulnerable parsing path. No authentication or elevated privileges are required on the target system before the file is opened. The crafted file executes shellcode or a loader stage once the parser corrupts memory.

No verified proof-of-concept code is published. See the Adobe Security Update APSB26-172 for authoritative technical references.

Detection Methods for CVE-2026-104341

Indicators of Compromise

• Unexpected child processes spawned by FrameMaker.exe, particularly cmd.exe, powershell.exe, rundll32.exe, or wscript.exe
• FrameMaker process crashes with access-violation exceptions recorded in Windows Error Reporting (WER)
• FrameMaker initiating outbound network connections to unknown hosts shortly after opening a document
• Creation of executables or scripts in %APPDATA%, %TEMP%, or user profile paths following document open

Detection Strategies

• Hunt for FrameMaker process trees that deviate from baseline parent-child relationships
• Monitor file-open telemetry for FrameMaker documents arriving from external email or internet-zone sources
• Correlate FrameMaker crash events with subsequent process creation or network activity on the same host
• Flag loads of unsigned or suspicious DLLs inside the FrameMaker process space

Monitoring Recommendations

• Enable detailed process creation auditing (Event ID 4688) with command-line logging across endpoints with FrameMaker installed
• Forward Sysmon Process Create, Image Load, and Network Connect events to a central analytics platform
• Alert on FrameMaker invoking Living-Off-the-Land Binaries (LOLBins)
• Track user-reported crashes of FrameMaker as potential exploitation attempts

How to Mitigate CVE-2026-104341

Immediate Actions Required

• Apply the Adobe FrameMaker patches referenced in Adobe Security Update APSB26-172 on all affected endpoints
• Inventory FrameMaker installations across the environment and prioritize internet-connected and high-value user workstations
• Instruct users to open FrameMaker documents only from trusted internal sources until patches are deployed
• Block inbound email attachments with FrameMaker file extensions at the mail gateway until remediation completes

Patch Information

Adobe released fixed versions as part of advisory APSB26-172. Administrators should consult the Adobe Security Update APSB26-172 for the exact fixed version numbers and download locations. Deploy the update through standard software distribution tooling and verify versions post-install.

Workarounds

• Restrict FrameMaker usage to a limited set of users with the business need, reducing the exposure surface
• Open untrusted FrameMaker files only inside isolated sandboxes or virtual machines without network access
• Enforce Windows Attack Surface Reduction (ASR) rules that block Office and productivity applications from spawning child processes, and apply equivalent application-control policies to FrameMaker
• Deploy Microsoft Exploit Protection with Data Execution Prevention (DEP) and mandatory ASLR against the FrameMaker.exe image

# Example: Add FrameMaker.exe to Windows Exploit Protection with mandatory ASLR and DEP
Set-ProcessMitigation -Name "FrameMaker.exe" -Enable DEP,EmulateAtlThunks,ForceRelocateImages,BottomUp,HighEntropy,TerminateOnError

# Example: Block FrameMaker file extensions at the mail gateway (pseudo-config)
# deny attachments where extension in (.fm, .mif, .book) from external senders