Adobe Photoshop CVE-2026-100112

Exploitation requires a victim to open an attacker-crafted malicious file (image/project file) in a vulnerable Photoshop Desktop build (version ≤27.10 or ≤26.11.7); code executes only with the privileges of the current user. Limiting factors: mandatory user interaction (UI:R) and local attack vector (AV:L) mean there is no remote or network-triggered path and no automated mass exploitation - the attacker must socially engineer file delivery and opening. No special product configuration is required; default installations are affected.

The input CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity, unauthenticated flaw that requires user interaction - consistent with a file-open attack rather than remote network exploitation. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is not listed in CISA KEV and no public exploit code is referenced, so this is 'no public exploit identified at time of analysis.' The reliance on a victim opening a malicious file (UI:R) and the absence of KEV/POC signals substantially lowers real-world urgency relative to the 7.8 base score, which is driven by the high C/I/A impact of arbitrary code execution. This is a credible but not emergency priority: patch in normal cycles, prioritize endpoints where analysts/designers routinely open untrusted image files. Note the apparent tension between the 'RCE' tag and AV:L - this is code execution via a local malicious file, not remote network-triggered RCE; the AV:L vector is the authoritative signal.

An attacker crafts a malicious image or document file that triggers the out-of-bounds write when parsed and delivers it via email, download, or a shared asset repository. When a victim opens the file in a vulnerable Photoshop Desktop build (≤27.10 or ≤26.11.7), the memory corruption is leveraged to execute arbitrary code in the context of the current user. No public proof-of-concept is referenced at the time of analysis.