CVE-2026-103857

MediumCVSS 5.5/10Last modified Oct 14, 2026

Description

Adobe Framemaker is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 14, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1038585.3MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies tCVE-2026-1038686.5A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused foCVE-2026-1038696.5A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reCVE-2026-1038705.0A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A userCVE-2026-1038779.8Deserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answeCVE-2026-1038787.5Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after aCVE-2026-1038807.5Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high forCVE-2026-1038846.5A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server failCVE-2026-1038857.5Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consumeCVE-2026-1038886.1The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'woosq-redirect' paramCVE-2026-1038899.8The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and includingCVE-2026-1038958.1The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to,
CVE-2026-103857: Medium severity, CVSS 5.5 | Vulnix