Adobe Photoshop CVE-2026-100111

Exploitation requires the victim to manually open an attacker-supplied malicious file in Adobe Photoshop Desktop (vulnerable builds ≤27.10 or ≤26.11.7); the OOB write is reached through Photoshop's file-parsing of that crafted file. This is a local vector (AV:L) with no authentication of the attacker but mandatory user interaction (UI:R) - there is no remote or network-triggered path and no autonomous/automatable exploitation. The primary limiting factors are the social-engineering step (the user must be convinced to open the file) and the fact that resulting code execution is confined to the current user's privilege level (S:U), not SYSTEM/root unless combined with a separate privilege-escalation flaw.

This is a genuine but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) scores 7.8 (High) because the impact is full code execution (C:H/I:H/A:H) in the current user's context, but the local attack vector plus required user interaction materially constrain real-world risk - an attacker cannot reach this remotely or autonomously; a victim must be socially engineered into opening a malicious file. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no signal of active exploitation or automatable weaponization (SSVC 'exploitation' would currently read as none/no-known-exploitation). The signals are internally consistent - no conflict between the vector and the description, both of which describe local, user-interaction-gated file-parsing exploitation. In SSVC terms: exploitation=none known, automatable=no (requires per-victim social engineering), technical impact=total. Net: patch in the normal cycle, prioritize analyst/designer workstations that handle untrusted artwork, but this does not warrant emergency out-of-band response absent emerging exploitation evidence.

An attacker crafts a malicious image file (e.g., a PSD or other supported format) that triggers an out-of-bounds write when parsed and emails or shares it with a target, perhaps posing as a client sending artwork. When the victim opens the file in a vulnerable Photoshop Desktop build, the memory corruption is leveraged to execute arbitrary code with that user's privileges. No public exploit identified at time of analysis, so weaponization would require the attacker to develop a working exploit for the OOB write.