EUVD-2026-100682
GHSA-jh93-8rh9-5j3v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious file to victim
-
DeliveryVictim opens file in Photoshop
-
ExploitTrigger out-of-bounds write in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user session and data
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious file in a vulnerable Photoshop Desktop build (≤26.11.7 in the 26.x line or ≤27.10 in the 27.x line); there is no network-triggerable or unauthenticated path. The limiting factors are significant: the attack vector is local (AV:L), the attacker must deliver the crafted file to the target, and the victim must actively open it (UI:R), so the flaw cannot be triggered remotely or automatically. No special product feature or non-default configuration is required beyond running an affected version and opening the file; code executes only with the privileges of the current user, not elevated. |
| Impact | This is a credible but not top-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects full confidentiality, integrity and availability impact via arbitrary code execution, but the attack vector is LOCAL and requires user interaction - the victim must be socially engineered into opening a malicious file. There is no CISA KEV listing and no public exploit identified, and no EPSS score was provided in the input, so there is no positive signal of active or imminent mass exploitation. No SSVC decision data was supplied. The signals are internally consistent: a memory-corruption RCE in a desktop file-parsing application is a classic spearphishing/malicious-document risk rather than a wormable or internet-facing threat. Net assessment: patch on a normal-to-expedited cadence; this is a real client-side RCE worth remediating but, absent exploitation evidence, it is not an emergency on the level of a remote unauthenticated network flaw. |
| Exploit ScenarioDerived | An attacker crafts a malicious image/document file that triggers an out-of-bounds write in Photoshop's file parser and emails or otherwise delivers it to a target. When the victim opens the file in a vulnerable Photoshop Desktop version, the memory corruption is leveraged to execute arbitrary code in the context of the current user. No public exploit code has been identified at the time of analysis, and the local vector plus required user interaction make this a targeted social-engineering scenario rather than automated mass exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to achieve arbitrary code execution in the context of the current user when a victim opens a specially crafted file; affected builds are Photoshop 26.x up to and including 26.11.7 and 27.x up to and including 27.10. The flaw is rated CVSS 3.1 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning no credentials are required but the attacker must deliver a malicious file locally and the victim must actively open it, so there is no remote or automatic trigger path. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; consistent with the authoritative assessment, this is a credible but not top-tier priority, with memory-corruption exploitation potentially unreliable and code executing only at the current user's privilege level, not elevated. Adobe documents the fix in security bulletin APSB26-158.
RemediationAI
Adobe addresses this flaw through security bulletin APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html); the provided data confirms the vendor advisory but does not state the exact patched build numbers, so treat this as patch available per vendor advisory and update Photoshop to the fixed release listed in APSB26-158 for your release line, upgrading from the affected ranges (26.x through 26.11.7 and 27.x through 27.10) using the Creative Cloud desktop updater or the vendor's offline installer. Because the vector is local with UI:R, there is no network port or service to disable and no authentication control to tighten; the practical compensating controls are content-handling restrictions applied until patching completes. Prohibit opening Photoshop documents and imported image files from untrusted or unsolicited sources and route them through a separate, sandboxed or non-production host with an isolated user account - effective, but it adds workflow friction and does not protect users who ignore the policy. Run Photoshop day-to-day as a standard (non-administrator) user, since the exploit is confined to the current user's privileges - this limits blast radius but does not prevent the compromise itself. Enable endpoint protection with memory-corruption and exploit-mitigation coverage (for example Windows Defender ASR rules and EDR behavioral detection on Photoshop child processes) to catch post-exploitation behavior such as spawned shells or unexpected network egress, accepting that such detections are probabilistic and cannot substitute for the patch. Given no CISA KEV listing and no public exploit code identified at time of analysis, patching can follow a normal risk-based cycle rather than emergency change procedures, prioritizing creative and design workstations that routinely open externally sourced files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-787 (Out-of-bounds Write), a memory-corruption weakness typically found in file-format parsers where a length, offset, or dimension field in the input file is trusted without adequate bounds validation, causing a write past the end of an allocated buffer (commonly heap-based) and, in the exploitable case, attacker-influenced control of adjacent memory and ultimately code execution. Photoshop Desktop parses a large family of complex, attacker-controllable document and image formats (PSD/PSB and imported raster/vector formats), and this OOB write sits in that parsing surface; the tagged 'RCE', 'Buffer Overflow', and 'Memory Corruption' labels are consistent with that picture. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack vector with no privileges required (PR:N), but with UI:R the exploit only fires after the victim opens the malicious document. Scope is Unchanged and the confidentiality, integrity, and availability impacts are all High, so a successful exploit yields full control of the process and the data it can reach, but strictly at the privilege level of the logged-in user rather than system-level. The availability of the exploit is therefore gated by delivery and social engineering rather than by network reachability, and the EUVD record (EUVD-2026-100682) enumerates the affected version ranges as Photoshop 0 through 26.11.7 and 0 through 27.10.
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by a user so AV:L and UI:R; no prior auth needed to craft/deliver the file (PR:N); code execution yields full C/I/A impact.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop builds 26.x through 26.11.7 and 27.x through 27.10 contain an out-of-bounds write that can allow code execution as the logged-in user when a crafted file is opened. Because exploitation requires a person to open a malicious file and there is no public exploit identified at time of analysis, the risk is targeted rather than broad, but creative and design teams handling untrusted files are most exposed. Leadership should treat this as a medium business risk requiring inventory, user caution, and patch tracking rather than emergency containment.
No vendor-released patch identified at time of analysis; interim mitigations include restricting users from opening untrusted Photoshop files, email and web filtering for suspicious attachments, application allowlisting, least privilege so Photoshop runs as a standard user, endpoint detection and response monitoring for Photoshop spawning unusual child processes, and user awareness training. Apply vendor patch when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Exploit-DB