CVE-2020-9635: 
Adobe Framemaker vulnerability analysis and mitigation

Adobe Framemaker versions 2019.0.5 and below were found to contain an out-of-bounds write vulnerability (CVE-2020-9635). The vulnerability was discovered by Francis Provencher working with Trend Micro's Zero Day Initiative and was publicly disclosed on June 9, 2020. This security flaw affects Adobe Framemaker's PDF file parsing functionality (NVD, ZDI Advisory).

The vulnerability is classified as an out-of-bounds write (CWE-787) issue that occurs during PDF file parsing. The specific flaw exists due to lack of proper validation of user-supplied data, which can result in a write operation before the start of an allocated object. The vulnerability has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (ZDI Advisory, NVD).

Successful exploitation of this vulnerability could lead to arbitrary code execution in the context of the current process. The vulnerability has been assessed with high impacts on confidentiality, integrity, and availability of the affected systems (NVD).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious file. The attack complexity is considered low, requiring no privileges, but does need user interaction for successful exploitation (ZDI Advisory).

Adobe has released security updates to address this vulnerability. Users are advised to update to the latest version of Adobe Framemaker through the official security bulletin (Adobe Advisory).