EUVD-2026-100680
GHSA-r557-2gxc-9vcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious file to victim
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger heap buffer overflow in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-crafted malicious file in Photoshop Desktop - this user interaction (UI:R) and the local file-delivery vector (AV:L) are the primary limiting factors; there is no network-facing or unauthenticated-remote path. Affected configurations are Photoshop Desktop at versions ≤26.11.7 and ≤27.10 (per EUVD); versions above these ranges are not affected. No special non-default feature or setting is called out in the advisory - any default install that opens the malicious file format is exposed. Resulting code execution is limited to the privileges of the current user (S:U), so impact is bounded by that account's rights. |
| Impact | The CVSS 3.1 base score of 7.8 (High) is driven by full CIA impact (C:H/I:H/A:H) but is critically gated by two metrics: AV:L (local attack vector) and UI:R (user interaction required). This is a file-parsing vulnerability - the 'local' vector reflects that an attacker must deliver a malicious file that the victim opens in Photoshop, not that network reachability exists. Code execution is confined to the current user's context (S:U, no privilege escalation). No EPSS score was supplied in the input, and the vulnerability is NOT in CISA KEV, with no public POC referenced - only a vendor advisory from Adobe PSIRT. There is no SSVC decision data provided. On balance this is a real but client-side, interaction-dependent risk typical of creative-application file-format flaws: it is a legitimate patch priority for organizations running Photoshop, but it is not a mass-exploitable, wormable, or network-facing issue. The absence of KEV/POC/EPSS signals suggests no evidence of active exploitation at time of analysis, so remediation can follow a standard patch cycle rather than emergency response, absent new threat intelligence. |
| Exploit ScenarioDerived | An attacker crafts a malicious image/project file that triggers a heap-based buffer overflow in Photoshop's file parser and delivers it via email, a shared drive, or a download disguised as a legitimate asset. When the victim opens the file in a vulnerable Photoshop Desktop version, the overflow corrupts heap memory and allows arbitrary code execution in the victim's user context. No public exploit code is identified in the provided data, so this remains a theoretical-but-credible chain pending any POC release. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Opening an attacker-crafted file in Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) can trigger a heap-based buffer overflow and lead to arbitrary code execution in the context of the current user. The CVSS 3.1 base score of 7.8 (High) reflects full confidentiality, integrity, and availability impact, but is gated by the local attack vector (AV:L) and mandatory user interaction (UI:R) - the victim must actively open the malicious file, so there is no network-facing or unauthenticated-remote exploitation path. No public exploit code has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; resulting code execution is bounded by the privileges of the user who opens the file (S:U).
RemediationAI
Patch availability per vendor advisory: Adobe has published APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html), which documents the fixed Photoshop builds for the affected 26.x and 27.x trains - update Photoshop Desktop via the Creative Cloud updater or the installer referenced in that bulletin, and confirm the installed build is above 26.11.7 / 27.10. If immediate patching is not possible, treat every inbound image/document file as untrusted: block or quarantine unsolicited files at the email gateway and web proxy, and instruct users not to open Photoshop files from unknown senders - this directly removes the UI:R trigger but relies on user compliance and is therefore only a stopgap. Because execution is limited to the current user's rights (S:U), running Photoshop under a least-privilege, non-administrative account meaningfully caps the blast radius; the trade-off is that some workflows requiring elevated file or plug-in access may break. Application allowlisting/sandboxing or EDR exploit-mitigation modules (heap integrity enforcement, ASLR/DEP hardening) can raise the bar for converting the overflow into reliable code execution, at the cost of occasional compatibility issues with third-party plug-ins. Network segmentation and port filtering provide no benefit here, as exploitation is purely local file-open driven; conversely, restricting users from opening files dragged in from shared/network locations reduces the primary delivery path but is difficult to enforce without disrupting normal creative workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a heap-based buffer overflow (CWE-122), a memory-safety class in which a program writes more data into a heap-allocated buffer than it can hold, corrupting adjacent heap metadata and objects; with careful layout control this often escalates from a crash to controlled code execution. In Photoshop Desktop, the vulnerable code path is reached through parsing of a user-supplied file, meaning the root cause sits in the file-format handling/decoding logic that processes attacker-controlled fields (dimensions, lengths, or chunk sizes) without adequate bounds validation. Per the assessed CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, the attack is local to the workstation (AV:L), needs no prior privileges (PR:N) but requires the victim to open the file (UI:R), and does not cross a security scope boundary (S:U) - so the injected code runs with the same rights as the Photoshop process owner rather than escalating to system privileges. The affected code base spans the Photoshop 26.x and 27.x desktop release trains, with the EUVD entry listing Photoshop 0 ≤ 26.11.7 and 0 ≤ 27.10 as the vulnerable ranges; no separate CPE strings were provided in this data set, so product identification relies on the vendor advisory APSB26-158 and the EUVD version ranges.
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-open RCE: AV:L and UI:R because a victim must open a malicious file; PR:N since no authentication is needed; S:U and full C/I/A:H for in-context arbitrary code execution.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop (versions 26.11.7 and earlier, and 27.10 and earlier) is affected by a heap-based buffer overflow that lets an attacker run arbitrary code at the privilege level of the user who opens a crafted file. Exposure is limited to staff who actively open untrusted image or document files on their own workstations - there is no network-facing or remote exploitation path - but no vendor patch is currently available, so the organization is dependent on user behavior and endpoint controls until Adobe ships a fix. Leadership should care because a successful attack grants full control of the affected creative workstation and the data it can reach, and remediation cannot yet be completed through patching alone.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and vet all externally sourced Photoshop files before opening; block or quarantine unsolicited graphic/document attachments at the email and web gateway; enforce standard (non-administrator) user privileges for Photoshop users to bound code execution; maintain EDR monitoring on Photoshop processes for anomalous child process creation or file writes; and apply any interim hardening guidance published in Adobe's advisory for versions 26.11.7 and earlier and 27.10 and earlier.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Exploit-DB