Adobe Photoshop EUVD-2026-100678

Exploitation requires the victim to open an attacker-supplied malicious file in Photoshop Desktop (versions ≤27.10 on the 27.x track or ≤26.11.7 on the 26.x track); this is the specific precondition. The attack vector is local (AV:L), so the attacker must deliver the file to the target and rely on the user opening it - there is no remote or network-triggerable path. Limiting factors: mandatory user interaction (UI:R), no authentication relationship needed on the attacker's side, and impact restricted to a denial-of-service crash with no confidentiality or integrity consequence, so realistic risk is confined to disruption rather than compromise.

This is a moderate-severity, low-urgency issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5) shows the only impact is availability - a NULL pointer dereference (CWE-476) that crashes Photoshop. There is no confidentiality or integrity impact and no code execution, so the worst outcome is a localized application denial-of-service. The vector is local (AV:L) and depends on user interaction (UI:R: the victim must open a malicious file), which meaningfully constrains real-world exploitability. No EPSS score was supplied, so exploitation probability cannot be quantified from this data. There is no CISA KEV listing and no public exploit identified at time of analysis; combined with the DoS-only impact, this points to low practical priority rather than an urgent threat. SSVC-style reasoning agrees: technical impact is partial (availability-only), exploitation is not automatable (requires per-victim file delivery and manual open), and there is no evidence of active exploitation. No conflicting signals were found in the provided data, though the absence of EPSS and the lack of an explicit patched-version number in the description are gaps worth closing with the Adobe advisory.

An attacker crafts a malformed Photoshop-compatible file and uses social engineering (email attachment, shared project file, or download) to get a victim to open it in Photoshop Desktop. When the application parses the malicious file, it dereferences a NULL pointer and crashes, denying the user access to the application until restart. No public exploit code was identified, and the flaw yields only a crash, not code execution or data access.