CVE-2020-9726: 
Adobe Framemaker vulnerability analysis and mitigation

Adobe FrameMaker version 2019.0.6 and earlier versions were found to contain an out-of-bounds read vulnerability (CVE-2020-9726). The vulnerability was disclosed on September 10, 2020, and affects Adobe's document processing software designed for writing and editing large or complex documents. User interaction is required to exploit this vulnerability, as the target must visit a malicious page or open a malicious FrameMaker file (NVD, ZDI).

The vulnerability exists within the parsing of FM files, where crafted data can trigger a read past the end of an allocated buffer. The severity of this vulnerability has been assessed with multiple CVSS scores: Adobe Systems provided a CVSS v3.1 Base Score of 6.1 (Medium) with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:L, while Zero Day Initiative assessed it with a higher CVSS score of 7.8. The vulnerability is classified as CWE-125 (Out-of-bounds Read) (NVD, ZDI).

Successful exploitation of this vulnerability could lead to reading past the end of an allocated buffer, potentially resulting in a crash or disclosure of sensitive information from other memory locations. An attacker could leverage this vulnerability to execute code in the context of the current process (NVD, ZDI).

The vulnerability requires user interaction to be exploited, specifically the target must visit a malicious page or open a malicious FrameMaker file. The vulnerability was initially reported to Adobe on May 26, 2020, before its public disclosure on September 10, 2020 (ZDI).

Adobe has released version 2019.0.7 of FrameMaker to address this vulnerability. Users are advised to update to this patched version to mitigate the risk (Qualys).