Adobe Photoshop CVE-2026-95635

Exploitation requires the victim to open an attacker-supplied malicious file in Photoshop Desktop (UI:R) - there is no remote or unauthenticated network trigger. The affected configurations are Photoshop Desktop versions ≤27.10 and ≤26.11.7 per the EUVD record; default installations are vulnerable with no special feature or non-default setting called out in the advisory. Key limiting factors: the attack vector is local (AV:L), so the attacker must get the crafted file onto the victim's system and the victim must actively open it in Photoshop; code runs only at the current user's privilege level (S:U, no privilege escalation), so impact is bounded by that user's rights rather than granting system-level control.

This is a credible but not emergency-level priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity flaw that needs no attacker privileges but DOES require user interaction - the victim must open a malicious file. That UI:R plus AV:L combination is the decisive risk-limiter: this is not a wormable, remotely-triggerable network bug but a classic file-format/memory-corruption issue that depends on social engineering to deliver the crafted file. On exploitation signals, the picture is reassuring but incomplete: no EPSS score was provided in the input, there is no CISA KEV listing, and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' SSVC-style reading: exploitation=none observed, automatable=no (requires per-victim user interaction), technical impact=total (C:H/I:H/A:H, code execution as the current user). The signals are internally consistent - a high CVSS driven by impact severity rather than by ease/breadth of exploitation. Double Free (CWE-415) bugs are realistically weaponizable into code execution by skilled actors, so the HIGH rating is justified, but absent KEV/POC/EPSS data this should be patched on a normal prioritized cycle rather than treated as an active-exploitation fire drill.

An attacker crafts a malicious Photoshop-parseable file (e.g. a booby-trapped image/document) and delivers it via email, a shared drive, or a download, luring the victim into opening it in Photoshop Desktop. Parsing triggers the double free in CWE-415, which an attacker grooms into memory corruption and arbitrary code execution running with the privileges of the current user. No public exploit code is identified at time of analysis, so working exploitation would require the attacker to develop the primitive themselves.