EUVD-2026-74065
GHSA-8gwp-p695-99gw
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parse exploitation is inherently local (AV:L), requires no privileges (PR:N), mandates opening a malicious file (UI:R), and yields full user-context compromise (C/I/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
Lifecycle Timeline
2DescriptionCVE.org
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
AnalysisAI
Integer overflow in Adobe Photoshop Desktop (2025 ≤26.11.6 and 2026 ≤27.6) enables arbitrary code execution in the context of the current user when a specially crafted malicious file is opened. The attack vector is local (AV:L) with mandatory user interaction (UI:R), making social engineering - phishing with a weaponized design file - the primary delivery mechanism. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a victim to open a specially crafted malicious file using a vulnerable version of Adobe Photoshop Desktop (2025 ≤26.11.6 or 2026 ≤27.6). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 base score (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent: local attack vector reflects that file parsing occurs on the victim's machine, low complexity means no race condition or environment dependency, PR:N confirms no account privileges are needed to open a file, and the full C/I/A:H triad reflects potential for complete user-context compromise. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update Adobe Photoshop 2025 to a version above 26.11.6, and Photoshop 2026 to a version above 27.6, per Adobe Security Bulletin APSB26-130 (https://helpx.adobe.com/security/products/photoshop/apsb26-130.html). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running Photoshop 2025 ≤26.11.6 or 2026 ≤27.6 and communicate to design teams that unsolicited or untrusted design files should not be opened without verification of source legitimacy. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Same weakness CWE-190 – Integer Overflow or Wraparound
View allShare
External POC / Exploit Code
Leaving vuln.today