Adobe Photoshop CVE-2026-105896

Exploitation requires a victim to open an attacker-supplied malicious file in Photoshop Desktop; it is not remotely triggerable and the CVSS vector confirms local access with required user interaction (AV:L/UI:R). The affected builds are Photoshop versions up to and including 27.10 and up to and including 26.11.7 - later/patched builds are not vulnerable. Limiting factors that reduce real-world risk: the attack is entirely gated on social engineering to get the file opened, there is no privilege escalation or code execution, and impact is confined to crashing the local application (availability only). No special non-default configuration is needed - the parsing path is reached through normal file-opening behavior.

This is a genuine but modest-priority issue, not a high-urgency flaw. The CVSS 3.1 base score of 5.5 (MEDIUM) is driven entirely by availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N), consistent with a CWE-476 NULL Pointer Dereference that only crashes the application. Critically, the vector is local (AV:L) and requires user interaction (UI:R): the victim must open a malicious file, so there is no remote or automatable mass-exploitation path. No EPSS score was provided in the input, and there is no CISA KEV listing and no known public exploit, so all exploitation signals point to low real-world urgency. There is no conflict between the signals - the description ('must open a malicious file') aligns well with the AV:L/UI:R vector. The practical worst case is a denied/crashed Photoshop session, not code execution or data compromise; AC:L means that once a victim opens the crafted file the crash is reliable, but the dependence on user action and the availability-only impact keep this firmly in the patch-on-normal-cycle category rather than emergency remediation.

An attacker crafts a malformed image or project file that triggers a NULL pointer dereference in Photoshop's file parser and delivers it to a victim (e.g., via email, a shared asset, or a download). When the victim opens the file in a vulnerable Photoshop Desktop build, the application dereferences the null pointer and crashes, producing a denial-of-service with possible loss of unsaved work. No public exploit code has been identified at time of analysis, and the attack yields only a crash - not code execution or data theft.