What is the CVSS score of CVE-2026-27289?

CVE-2026-27289 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Photoshop are affected by CVE-2026-27289?

Adobe Photoshop Desktop versions 27.4 and earlier contain an out-of-bounds read vulnerability that allows arbitrary code execution when users open malicious files, potentially compromising design and…

How to fix or mitigate CVE-2026-27289?

Within 24 hours: Inventory all Adobe Photoshop Desktop installations and identify version numbers across the organization; restrict file handling from untrusted external sources to designated isolated machines. Within 7 days: Implement application whitelisting for Photoshop and enforce execution controls; provide user awareness communication about opening files only from trusted sources. Within 30 days: Monitor Adobe security advisories daily for patch release to version 27.5 or later; prepare staged deployment plan for immediate patching upon availability.

Photoshop CVE-2026-27289

EUVD-2026-22687 HIGH

Out-of-bounds Read (CWE-125)

2026-04-14 psirt@adobe.com

GHSA-p744-7x6c-3vvc

Buffer Overflow Information Disclosure Photoshop

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 22:37 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 20:22 euvd

EUVD-2026-22687

Analysis Generated

Apr 14, 2026 - 20:22 vuln.today

CVE Published

Apr 14, 2026 - 20:16 nvd

HIGH 7.8

DescriptionCVE.org

Photoshop Desktop versions 27.4 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Out-of-bounds read in Adobe Photoshop Desktop 27.4 and earlier enables arbitrary code execution when users open malicious files. Attackers can read beyond allocated memory boundaries during file parsing to execute code with current user privileges. CVSS 7.8 (High) reflects local attack vector requiring user interaction. No public exploit identified at time of analysis, though exploitation requires only low complexity once a victim opens the crafted file.

Technical ContextAI

This vulnerability manifests as CWE-125 (Out-of-bounds Read) in Adobe Photoshop Desktop's file parsing routines. When processing specially crafted files, the application reads memory beyond the boundaries of allocated structures, potentially exposing sensitive information or control flow data. Out-of-bounds read vulnerabilities commonly occur in complex file format parsers where insufficient bounds checking allows access to adjacent memory regions. In Photoshop's case, the parsing logic fails to validate buffer boundaries when interpreting malformed file structures, enabling attackers to leverage the read primitive for code execution. The vulnerability affects Photoshop Desktop versions up through 27.4, indicating the flaw exists in core file handling components used across multiple product iterations.

RemediationAI

Adobe has released security updates addressing this vulnerability in Photoshop Desktop versions later than 27.4. Users should immediately upgrade to the latest patched version available through Adobe Creative Cloud's update mechanism or direct download from Adobe's website. Detailed patch information and download links are available in Adobe Security Bulletin APSB26-40 at https://helpx.adobe.com/security/products/photoshop/apsb26-40.html. As an interim mitigation for environments unable to immediately patch, organizations should restrict opening Photoshop files to trusted sources only, implement application sandboxing where possible, and educate users about the risks of opening unsolicited or suspicious PSD files from unknown origins. File scanning and validation through security tools before opening in Photoshop can provide additional defense-in-depth protection.