EUVD-2026-100681
GHSA-8234-2mg9-p6m6
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver to victim via email or download
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger integer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Integer overflow checks
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in Photoshop Desktop (UI:R); it is not remotely triggerable without this action. The vector is local (AV:L) and requires no prior authentication or privileges (PR:N), but code executes only in the context of the current user (S:U) with no privilege escalation. Affected versions are Photoshop ≤27.10 and ≤26.11.7; the primary limiting factors are the mandatory user interaction and the need to deliver the crafted file and induce the user to open it, which favors targeted social-engineering over opportunistic mass exploitation. |
| Impact | This is a credible but not top-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring user interaction - the victim must open a malicious file - rather than remote network exploitation, which meaningfully constrains mass or automated attacks. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no proof-of-concept or public exploit is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The dominant driver of risk is social engineering: an attacker must convince a user to open a crafted file, after which code runs only in the context of the current user (S:U, no privilege escalation). This matches the recurring Adobe creative-application file-parsing pattern and is a patch-in-normal-cycle item rather than an emergency, absent any exploitation signal. If future EPSS or KEV data emerges, re-prioritize accordingly. |
| Exploit ScenarioDerived | An attacker crafts a malicious image/document file that triggers an integer overflow in Photoshop's file parser and distributes it via email, a shared project, or a download posing as a legitimate design asset. When the victim opens the file in a vulnerable Photoshop Desktop version, the overflow corrupts memory and allows arbitrary code execution in the victim's user context. No public exploit code is identified at time of analysis, and successful attack depends entirely on the user opening the file. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Arbitrary code execution in Adobe Photoshop Desktop (27.x up to and including 27.10, and 26.x up to and including 26.11.7) is possible when a user opens a specially crafted file, because an integer overflow or wraparound during file parsing corrupts memory and lets attacker-controlled code run in the context of the current user. Exploitation is local in nature - the attacker must deliver a malicious file and convince the victim to open it - and, per the CVSS vector (AV:L, PR:N, UI:R, S:U), no prior authentication is needed but no privilege escalation is gained, since code executes only with the victim's own rights. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so the practical risk is a credible but not top-tier priority driven by targeted social engineering rather than opportunistic mass exploitation.
RemediationAI
The primary fix is to update Adobe Photoshop Desktop to the released patched version documented in the vendor advisory at https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html; the supplied intelligence establishes the vulnerable ranges as ≤27.10 and ≤26.11.7 but does not confirm an exact fixed version string, so verify the current patched build directly against the Adobe advisory before closing the finding - patch status should be recorded as "patch available per vendor advisory" rather than an independently confirmed fix version. Because exploitation requires the victim to open an attacker-supplied file, the most effective compensating controls target file delivery and opening: block or quarantine untrusted image/document attachments and downloads at mail and web gateways and strip files originating from external sources, at the cost of occasional false positives on legitimate creative workflows; enforce Mark-of-the-Web handling and open untrusted documents in a sandbox, disposable VM, or OS-level isolated environment, which adds friction but contains memory-corruption exploits to the sandbox; run Photoshop with least privilege and without administrative rights so that any successful exploit is confined to a low-value user context, consistent with the Unchanged scope rating; and combine user awareness training about unsolicited creative-file attachments with endpoint detection tuned to anomalous child processes spawned by Photoshop, since EDR alone will not prevent the initial trigger. None of these workarounds removes the underlying code-execution primitive, so applying the vendor update remains the only complete remediation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-190, an integer overflow or wraparound, in Photoshop Desktop's handling of crafted document files. In this class of bug, arithmetic performed on attacker-influenced length, size, or offset fields (for example when computing buffer sizes or record boundaries while parsing a file) overflows the integer type used, producing a wrapped, much smaller value; subsequent allocation or bounds-checking logic based on that value is inconsistent with the data actually written, leading to an out-of-bounds write and memory corruption that can be shaped into arbitrary code execution. The CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H vector confirms the attack surface: the malicious file must be present locally and be opened by the user (UI:R), no credentials or privileges are required (PR:N), and the impact is High for confidentiality, integrity, and availability but Unchanged for scope, meaning the attacker stays within the permissions of the current user rather than pivoting to the OS or other components. No CPE strings were supplied in the source data, so affected product identification relies on the vendor advisory and the EUVD version ranges rather than a machine-readable CPE.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the user (AV:L, UI:R); no auth needed (PR:N); integer overflow yields arbitrary code execution as the current user, giving full C/I/A impact without scope change.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Zero Day Initiative Advisories
Executive ViewAI
Adobe Photoshop Desktop (27.x through 27.10 and 26.x through 26.11.7) contains a memory-corruption flaw that lets a crafted image file run attacker-controlled code on a designer's workstation using only that user's own privileges, and no vendor fix is currently available. Risk is concentrated in creative, marketing, and design teams that routinely exchange layered artwork and image assets with external parties, where a single opened file is sufficient to compromise the endpoint. Leadership should treat this as a targeted social-engineering risk to high-value creative endpoints rather than a broad, opportunistic outbreak.
No vendor-released patch identified at time of analysis. Interim mitigations: run Photoshop under standard, non-administrative user accounts so any exploited code inherits minimal rights; block or quarantine inbound PSD and image attachments at email and collaboration gateways; require externally received artwork to be opened first in a sandboxed or virtualized host; enable endpoint hardening and detection (Attack Surface Reduction rules, EDR alerts on Photoshop spawning unexpected child processes or making anomalous outbound connections); and keep Creative Cloud updates on a managed channel so the vendor fix can be pushed centrally the moment it ships.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Integer overflow occurs when an arithmetic operation produces a result that exceeds the maximum value a given integer type can store.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB