EUVD-2026-100677
GHSA-55mq-c4jq-m333
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Photoshop-parseable file
-
DeliveryDeliver file to victim (email/share/download)
-
ExploitVictim opens file in Photoshop
-
ExecutionNULL pointer dereferenced in parser
-
ImpactApplication crashes (denial-of-service)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Null pointer safety, defensive checks
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a victim to open an attacker-supplied malicious file in Photoshop Desktop; it is not remotely triggerable and the CVSS vector confirms local access with required user interaction (AV:L/UI:R). The affected builds are Photoshop versions up to and including 27.10 and up to and including 26.11.7 - later/patched builds are not vulnerable. Limiting factors that reduce real-world risk: the attack is entirely gated on social engineering to get the file opened, there is no privilege escalation or code execution, and impact is confined to crashing the local application (availability only). No special non-default configuration is needed - the parsing path is reached through normal file-opening behavior. |
| Impact | This is a genuine but modest-priority issue, not a high-urgency flaw. The CVSS 3.1 base score of 5.5 (MEDIUM) is driven entirely by availability impact (A:H) with no confidentiality or integrity impact (C:N/I:N), consistent with a CWE-476 NULL Pointer Dereference that only crashes the application. Critically, the vector is local (AV:L) and requires user interaction (UI:R): the victim must open a malicious file, so there is no remote or automatable mass-exploitation path. No EPSS score was provided in the input, and there is no CISA KEV listing and no known public exploit, so all exploitation signals point to low real-world urgency. There is no conflict between the signals - the description ('must open a malicious file') aligns well with the AV:L/UI:R vector. The practical worst case is a denied/crashed Photoshop session, not code execution or data compromise; AC:L means that once a victim opens the crafted file the crash is reliable, but the dependence on user action and the availability-only impact keep this firmly in the patch-on-normal-cycle category rather than emergency remediation. |
| Exploit ScenarioDerived | An attacker crafts a malformed image or project file that triggers a NULL pointer dereference in Photoshop's file parser and delivers it to a victim (e.g., via email, a shared asset, or a download). When the victim opens the file in a vulnerable Photoshop Desktop build, the application dereferences the null pointer and crashes, producing a denial-of-service with possible loss of unsaved work. No public exploit code has been identified at time of analysis, and the attack yields only a crash - not code execution or data theft. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Opening a crafted, attacker-supplied file in Adobe Photoshop triggers a NULL pointer dereference that crashes the desktop application, producing a local denial-of-service condition. The issue affects Photoshop builds up to and including 27.10 on the current branch and up to and including 26.11.7 on the prior branch; exploitation is gated entirely on social engineering because the victim must open the malicious file, and there is no code execution, privilege escalation, or confidentiality/integrity impact - only availability of the local application. No public exploit identified at time of analysis, and this is a genuine but modest-priority issue rather than a high-urgency flaw.
RemediationAI
The primary fix is to update Adobe Photoshop past the affected ceilings to the patched builds named in Adobe's advisory APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html); the supplied intelligence identifies the vulnerable ranges as builds up to and including 27.10 on the 27.x branch and up to and including 26.11.7 on the 26.x branch, so an exact fixed build number should be taken from that advisory rather than assumed - vendor advisory states whether a patch is available for each branch, and Creative Cloud users should allow the updater to complete and verify the installed version afterwards. Where immediate upgrading is not possible, compensating controls are limited but usable: block or quarantine untrusted image/document files at the email gateway and edge, since the only trigger is a user opening a malicious file; restrict Photoshop file handling to trusted sources and disable OS-level preview/thumbnail generation handlers that parse the same formats automatically (trade-off: preview handlers are convenient and disabling them is only a partial reduction because the user can still open the file manually); and run Photoshop in a low-privilege account or an OS sandbox/isolated VM for untrusted content workflows (trade-off: added friction, reduced file-system access, and performance overhead, and it does not fix the bug). There is no available configuration toggle that disables the specific parsing code path, so none should be advertised as a workaround. Exploitation requires user interaction and no public exploit identified at time of analysis, so prioritise patching for users who routinely open externally supplied files rather than as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a NULL pointer dereference (CWE-476) in Adobe Photoshop Desktop's file-parsing path, a classic memory-safety defect in which the application follows a pointer it never validated - typically because an unexpected or malformed input structure causes an earlier allocation or lookup to fail or return NULL, and the subsequent dereference is unguarded. Photoshop opens and decodes a very large set of image and document formats, so this class of bug lives in the import/parse routines rather than in the editing engine; the result is a deterministic crash rather than memory corruption that could be steered toward code execution. The CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H confirms the exploitation preconditions: the attack surface is local (a file opened by the user), no privileges are required (PR:N), no authentication is involved, and the single required condition is user interaction (UI:R), because the file must be opened through normal application behaviour. No CPE strings were supplied with this record, so affected-product identification relies on the vendor advisory and the EUVD version ranges rather than formal CPE matching; the affected 26.x and 27.x branches are identified by Adobe's own advisory (APSB26-158).
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Exploitation needs only that a victim open a malicious file, so AV:L/AC:L/PR:N/UI:R; impact is a crash with no data exposure, hence C:N/I:N/A:H.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A null pointer dereference occurs when a program attempts to access memory through a pointer that has been set to NULL (address 0x0).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Arbitrary code execution in Adobe Photoshop Desktop is possible when a user opens an attacker-supplied file, because an
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Exploit-DB