EUVD-2026-100687
GHSA-5gr7-mwq5-qvrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver via phishing or file share
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious file in a vulnerable Photoshop Desktop build (versions ≤27.10 or ≤26.11.7). The limiting factors are significant: the attack vector is local (AV:L) with no network path, and mandatory user interaction (UI:R) means the victim must actively open the crafted file - Photoshop cannot be compromised remotely or without that action. No special product configuration or feature toggle is named in the advisory, so any default installation that opens the malicious file is affected. Code execution is confined to the current user's privilege context (S:U), so impact is bounded by that user's rights. |
| Impact | This is a genuine but not emergency-grade priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8) describes a local, file-borne attack: an attacker cannot reach the victim over the network but must deliver a malicious file that the victim opens in Photoshop, after which an out-of-bounds write (CWE-787) yields arbitrary code execution as the current user. No EPSS score, CISA KEV entry, SSVC decision, or public POC was provided in the intelligence set, so there is no evidence of active exploitation or weaponization; the risk is latent rather than demonstrated. The high C/I/A impact and PR:N (no prior authentication) are offset by UI:R (victim must open the file) and AV:L (no remote trigger), which is the classic profile for a client-side desktop RCE delivered via phishing or malicious document sharing. Note that PR:N here means no application-level privileges are needed, but exploitation still depends on social engineering to get the file opened - this is not a self-propagating or server-side flaw. Treat it as a standard-urgency patch for workstations handling untrusted image files, not a drop-everything network-exposed emergency. |
| Exploit ScenarioDerived | An attacker crafts a malicious Photoshop-compatible file (e.g., a PSD or supported image format) embedding data that triggers the out-of-bounds write, then delivers it via phishing email, a shared drive, or a download link. When the victim opens the file in a vulnerable Photoshop Desktop build, the memory corruption executes arbitrary code in the victim's user context. No public proof-of-concept was identified in the provided intelligence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop lets an attacker execute arbitrary code in the context of the current user when a victim opens a specially crafted malicious file. The vulnerability affects builds up to and including 27.10 and up to and including 26.11.7 (per ENISA EUVD), and carries a CVSS 3.1 score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - meaning the attack path is local, no privileges or authentication are required (PR:N), but the victim must actively open the file (UI:R), and any code that runs is confined to that user's rights. No public exploit code and no confirmed active exploitation were identified at time of analysis; it is a genuine but not emergency-grade priority, and Adobe has published security bulletin APSB26-158 (EUVD-2026-100687) covering the fix.
RemediationAI
Apply the Photoshop update published with Adobe security bulletin APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html); the advisory is the authoritative source for the exact fixed build on the 27.x and 26.x tracks, since the intelligence provided lists only the vulnerable ceilings (27.10 and 26.11.7) rather than the replacement version strings - do not infer fix numbers from the vulnerable ranges. In practice this means updating through the Creative Cloud desktop app or the vendor's updater and verifying the installed build after updating, and prioritizing workstations where Photoshop runs under an account with elevated local rights. The most effective compensating control is to stop malicious files from reaching the product: block or quarantine untrusted PSD/PSB and other image documents at the email gateway, warn or restrict downloads from unclassified sources, and prohibit opening client- or vendor-supplied design files straight from network shares, accepting the workflow friction this adds for design teams. Where the update cannot be deployed immediately, run Photoshop under a least-privilege standard user account or in a sandboxed/containered image-editing environment so that any exploitation is contained, which costs the ability to write to shared production paths. Application allowlisting and EDR rules that alert when Photoshop spawns unexpected child processes (script interpreters, shells, or system utilities) provide detection value but are detective rather than preventive, and disabling file-format handling or preview features may reduce the attack surface yet degrades core functionality, so it should only be used as a short-term stopgap.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-787, an out-of-bounds write, which places this in the classic memory-corruption family also tagged as buffer overflow and memory corruption by the reporting intelligence. Photoshop parses a wide range of complex, attacker-controllable document and image formats; a boundary error while processing such a file writes beyond the bounds of an allocated buffer, corrupting adjacent memory structures and giving an attacker a path to hijack control flow and achieve remote code execution inside the Photoshop process - hence the high C:H/I:H/A:H impact ratings. The AV:L/UI:R components of the assessed CVSS vector describe the delivery model rather than the severity of the corruption: the malicious file must be present locally (delivered via email attachment, web download, removable media, or a shared network folder) and the user must open it in the affected build, with no remote unauthenticated network exploit path and no special configuration or feature toggle identified in the advisory. Damage is bounded by the integrity of the current user's session - the S:U scope means no automatic privilege escalation beyond that account, though on a workstation with local administrative rights the practical blast radius grows. Two maintained release branches are in scope (the 27.x and 26.x lines), consistent with Adobe's typical multi-track Photoshop servicing model.
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AV:L and UI:R because the victim must locally open a malicious file; PR:N as no login is needed; C/I/A:H since arbitrary code runs in the user context.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop is affected by a high-severity out-of-bounds write vulnerability that could allow an attacker to execute arbitrary code on a user's system when they open a specially crafted file. This unauthenticated vulnerability requires user interaction and could lead to data compromise or malware installation, impacting creative teams and individuals relying on Photoshop. Leadership should prioritize mitigation due to the potential for unauthorized access to sensitive data and disruption of workflows.
No patch available: Implement user awareness training, restrict opening untrusted files, enable application whitelisting, use endpoint detection and response with exploit protection, and monitor Adobe advisory APSB26-158 for updates.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Exploit-DB