CVE-2026-104343: Adobe FrameMaker NULL Pointer DOS Vulnerability

CVE-2026-104343 Overview

CVE-2026-104343 is a NULL Pointer Dereference vulnerability [CWE-476] affecting Adobe Framemaker. An attacker can trigger an application crash by convincing a victim to open a malicious file, resulting in a denial-of-service condition. The vulnerability requires local access and user interaction to exploit.

Adobe disclosed the issue in security bulletin APSB26-172. The flaw does not expose confidentiality or integrity, but it fully disrupts application availability on the affected host.

Critical Impact
Successful exploitation crashes Adobe Framemaker, interrupting document workflows and causing potential loss of unsaved work when a user opens a crafted file.

Affected Products

Adobe Framemaker (versions listed in Adobe advisory APSB26-172)
Document processing workflows that rely on Framemaker for structured authoring
Windows workstations running vulnerable Framemaker releases

Discovery Timeline

2026-10-13 - CVE-2026-104343 published to the National Vulnerability Database (NVD)
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104343

Vulnerability Analysis

The vulnerability is a NULL Pointer Dereference [CWE-476] in Adobe Framemaker. When Framemaker parses a malformed file, the application dereferences a pointer that was never initialized or was set to NULL after a failed allocation or validation step. The dereference triggers an access violation that terminates the process.

The issue is a local, availability-only flaw. Attackers cannot read memory, write memory, or escalate privileges through this bug. However, the crash disrupts user productivity and may corrupt in-progress documents. The attack requires user interaction because the victim must open the malicious file in Framemaker.

File format parsers in authoring tools frequently contain this class of defect. Complex binary and markup inputs produce many code paths that may skip validation before dereferencing structure pointers.

Root Cause

The root cause is missing validation of a pointer value prior to dereference during file parsing. See the Adobe Security Update APSB26-172 for Adobe's technical description and affected version matrix.

Attack Vector

An attacker crafts a malicious Framemaker document and delivers it through email, shared storage, or a web download. The victim opens the file in Framemaker on their local workstation. Framemaker parses the malformed structures, dereferences a NULL pointer, and crashes. No network path exists for exploitation.

Detection Methods for CVE-2026-104343

Indicators of Compromise

Repeated Windows Error Reporting (WER) entries for FrameMaker.exe with access violation exception code 0xC0000005.
Unexpected Framemaker process terminations shortly after a user opens an external document.
Delivery of Framemaker file types (.fm, .mif, .book) from untrusted email senders or external file shares.

Detection Strategies

Monitor endpoint telemetry for FrameMaker.exe crash events correlated with recent file-open activity.
Flag process launches of FrameMaker.exe with command-line arguments pointing to files in download directories or email attachment caches.
Alert on application crash dumps generated in the Framemaker install path following document opens from untrusted sources.

Monitoring Recommendations

Collect and centralize Windows Application and WER event logs for Framemaker hosts.
Baseline normal Framemaker crash rates and alert on deviations across the user population.
Track inbound email attachments and web downloads matching Framemaker file extensions for retrospective investigation.

How to Mitigate CVE-2026-104343

Immediate Actions Required

Apply the Adobe Framemaker update referenced in Adobe Security Update APSB26-172.
Instruct users to avoid opening Framemaker files from untrusted or unverified sources until patching is complete.
Inventory all endpoints running Adobe Framemaker and prioritize patch deployment to authoring teams.

Patch Information

Adobe published fixes in bulletin APSB26-172. Administrators should download the updated Framemaker build from the Adobe Creative Cloud or enterprise distribution channel and deploy it to all affected endpoints. Verify installed versions against the fixed version matrix in the advisory after deployment.

Workarounds

Restrict Framemaker file types at email gateways and web proxies when inbound from external senders.
Open suspicious Framemaker documents only in an isolated virtual machine without access to production data.
Enforce application allow-listing and least-privilege user accounts to limit secondary impact of a crash.

bash

# Query installed Adobe Framemaker version on Windows endpoints
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*FrameMaker*" } | Select-Object Name, Version, Vendor