Adobe Photoshop EUVD-2026-100684

Exploitation requires a victim to open an attacker-crafted malicious file in a vulnerable Photoshop Desktop build (Photoshop ≤27.10 or ≤26.11.7); it cannot be triggered remotely without this local user action (AV:L, UI:R). No attacker authentication is required (PR:N), but the mandatory user interaction - convincing a user to download and open the malicious file - is the primary limiting factor, making social engineering (phishing, malicious shared assets) the realistic delivery path. There is no network-facing or default-service exposure; the application must actively process the malicious file.

This is a genuinely serious but not emergency-tier issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.6) tells a consistent story with the description: exploitation is LOCAL (AV:L) because it requires a victim to open a malicious file rather than a remote network trigger, needs no attacker authentication (PR:N) but does require user interaction (UI:R), and achieves a scope change (S:C) with full confidentiality/integrity/availability impact via arbitrary code execution in the current user's context. No EPSS score, CISA KEV listing, or POC indicator is present in the provided data, so by the precision rules this is 'no public exploit identified at time of analysis.' The CWE-863 (Incorrect Authorization) root cause combined with the file-open delivery vector makes this a classic malicious-document RCE class that Adobe patches routinely; such bugs are realistic targets for phishing/social-engineering campaigns but depend entirely on tricking a user. There is a minor labeling tension worth noting: the input Tag 'Authentication Bypass' is imprecise - the actual weakness is Incorrect Authorization (CWE-863), an authorization flaw, not an authentication bypass. Overall this is a real priority for organizations with large Creative Cloud/Photoshop footprints, but the local vector plus mandatory user interaction place it below remote-unauthenticated criticals.

An attacker crafts a malicious Photoshop-compatible file (e.g., a PSD or supported image format) that triggers the incorrect-authorization flaw and delivers it to a victim via phishing email, shared drive, or a downloaded asset. When the victim opens the file in a vulnerable Photoshop Desktop build, arbitrary code executes in the context of that user. No public exploit code is identified in the available data, and successful exploitation hinges on the user opening the attacker-supplied file (UI:R).