Adobe Photoshop CVE-2026-95641

Exploitation requires the victim to manually open an attacker-crafted malicious file in Photoshop Desktop (UI:R) on a vulnerable build - Photoshop at or below version 26.11.7, or at or below 27.10 per the EUVD data. The attack vector is local (AV:L): the attacker cannot trigger the flaw over a network and must get the malicious file onto the victim's system and induce them to open it. Although PR:N indicates no prior authentication to the application is needed, the mandatory user interaction and local-only vector are the principal limiting factors; code executes only with the opening user's privileges (S:U, no privilege escalation). No special non-default configuration is indicated in the available data.

This is a genuine but operationally moderate priority. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U) confirms a local attack vector requiring user interaction - the victim must open a malicious file - not remote unauthenticated exploitation, which caps the base score at 7.8 (High) despite full C:H/I:H/A:H impact. The CWE-787 out-of-bounds write yielding arbitrary code execution in the current user's context is a classic memory-corruption RCE pattern. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability and automatability cannot be quantified. There is no public exploit identified at time of analysis and no evidence of active exploitation; the file-open user-interaction requirement and local vector make this better suited to targeted social-engineering (malicious .PSD/image delivered via email or download) than mass, automatable exploitation. Treat as a standard-urgency patch for workstations handling untrusted files rather than an emergency, but note that Photoshop's large creative-user base and routine opening of externally-sourced files raise practical exposure.

An attacker crafts a malicious image/document file that triggers the out-of-bounds write when parsed by Photoshop Desktop, then delivers it to a victim via email, a shared drive, or a download disguised as a legitimate design asset. When the victim opens the file, the memory corruption executes attacker-controlled code with the victim's privileges. No public exploit is identified at time of analysis; the local vector and mandatory user interaction (UI:R) mean the attack hinges on social engineering rather than remote triggering.