Adobe Photoshop CVE-2026-83661

Exploitation requires the victim to open an attacker-crafted malicious file in a vulnerable Photoshop Desktop version (≤27.10 in the 27.x line or ≤26.11.7 in the 26.x line); the integer overflow is triggered during file parsing. The key limiting factor is mandatory user interaction (UI:R) - the attack cannot succeed without the user actively opening the malicious file - and the local attack vector (AV:L) means there is no remote, unauthenticated network-facing exposure. No special product configuration is named in the advisory; any default installation that opens the crafted file format is affected. Code execution is confined to the current user's privilege level (S:U), so impact is limited by the account under which Photoshop runs.

This is a moderate-priority, user-interaction-gated vulnerability rather than a mass-exploitation emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U, C:H/I:H/A:H, base 7.8) describes a local attack vector requiring a victim to open a malicious file - not remote network exploitation despite the PR:N (no pre-existing authentication). No EPSS score was provided, there is no CISA KEV listing, and no public proof-of-concept was referenced, so exploitation status is 'no public exploit identified at time of analysis.' An SSVC framing would place this at low automatability (exploitation depends on social-engineering a user into opening a crafted file) with total technical impact (arbitrary code execution in the current user's context). The signals are internally consistent: a file-format integer-overflow RCE in a desktop application that triggers only on malicious-file open. The main caveat is that PR:N can be misleading here - it reflects that no account credentials are needed, but the UI:R requirement (victim must open the file) is the real gating factor, so this is closer to a client-side phishing/weaponized-document risk than an exposed-service flaw. Treat it as a standard patch-cycle priority for workstations where Photoshop handles untrusted files.

An attacker crafts a malicious image or document file that triggers the integer overflow in Photoshop's parsing code and delivers it via email, a shared drive, or a download. When the victim opens the file in a vulnerable Photoshop Desktop version, the overflow leads to arbitrary code execution in the context of the current user. No public exploit code has been identified at time of analysis, and the AV:L/UI:R profile means the attack succeeds only if the user is socially engineered into opening the file.