Adobe Photoshop EUVD-2026-100681

Exploitation requires the victim to open an attacker-supplied malicious file in Photoshop Desktop (UI:R); it is not remotely triggerable without this action. The vector is local (AV:L) and requires no prior authentication or privileges (PR:N), but code executes only in the context of the current user (S:U) with no privilege escalation. Affected versions are Photoshop ≤27.10 and ≤26.11.7; the primary limiting factors are the mandatory user interaction and the need to deliver the crafted file and induce the user to open it, which favors targeted social-engineering over opportunistic mass exploitation.

This is a credible but not top-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a local attack vector requiring user interaction - the victim must open a malicious file - rather than remote network exploitation, which meaningfully constrains mass or automated attacks. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT listed in CISA KEV and no proof-of-concept or public exploit is referenced, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was supplied. The dominant driver of risk is social engineering: an attacker must convince a user to open a crafted file, after which code runs only in the context of the current user (S:U, no privilege escalation). This matches the recurring Adobe creative-application file-parsing pattern and is a patch-in-normal-cycle item rather than an emergency, absent any exploitation signal. If future EPSS or KEV data emerges, re-prioritize accordingly.

An attacker crafts a malicious image/document file that triggers an integer overflow in Photoshop's file parser and distributes it via email, a shared project, or a download posing as a legitimate design asset. When the victim opens the file in a vulnerable Photoshop Desktop version, the overflow corrupts memory and allows arbitrary code execution in the victim's user context. No public exploit code is identified at time of analysis, and successful attack depends entirely on the user opening the file.