Photoshop CVE-2026-27289

Adobe Photoshop Desktop versions 27.4 and earlier. Victim must open a crafted malicious file in Photoshop. No special configuration or authentication required. Local attacker or remote delivery of file via email/web.

Real-world risk is moderate despite the High CVSS 7.8 rating. The local attack vector (AV:L) requires the attacker to deliver a malicious file and convince the victim to open it, creating a significant social engineering barrier. Low attack complexity (AC:L) means exploitation is straightforward once file interaction occurs, and no privileges are required (PR:N) before the attack. However, mandatory user interaction (UI:R) substantially reduces automated exploitation risk. No public exploit identified at time of analysis and no CISA KEV listing indicate this is not currently mass-exploited. The SSVC framework would likely categorize this as 'attended' deployment priority rather than immediate, since exploitation is not automatable and requires user action. Organizations with users regularly handling untrusted Photoshop files from external sources face elevated risk, while environments with strict file source controls have lower practical exposure. The combination of high technical impact (C:H/I:H/A:H) with delivery friction creates a vulnerability more suited to targeted attacks than opportunistic campaigns.

An attacker crafts a malicious Photoshop file containing deliberately malformed structures that trigger out-of-bounds memory reads during parsing. The attacker distributes this file via email, file sharing platforms, or social engineering, enticing the victim to open it in Photoshop Desktop 27.4 or earlier. Upon opening, Photoshop's file parser reads beyond allocated memory boundaries, and the attacker leverages this primitive to execute arbitrary code with the victim's user privileges, potentially installing malware, exfiltrating data, or pivoting to network resources accessible to that user account.