Adobe Photoshop EUVD-2026-100685

Exploitation requires the victim to manually open a malicious, attacker-crafted file in Adobe Photoshop Desktop (versions ≤27.10 or ≤26.11.7); the flaw is triggered during file parsing. Limiting factors: it is a local, client-side attack with no network vector (AV:L), it depends on user interaction/social engineering to open the file (UI:R), and code executes only with the privileges of the current user (S:U), so it cannot be exploited remotely or without a human in the loop. Default configurations are affected - no special product setting is needed - but an unpatched Photoshop install and a user willing to open the file are both prerequisites.

This is a legitimate high-severity local code-execution flaw but not an emergency-tier internet-facing threat. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R) confirms exploitation is local and requires the victim to open an attacker-supplied file - there is no remote, unauthenticated, network-reachable surface despite PR:N. The CWE-787 out-of-bounds write yields full C:H/I:H/A:H impact in the current user's context, so a successful lure gives the attacker the victim's privileges. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis'; the UI:R requirement and client-side nature make mass/automatable exploitation unlikely and favor targeted phishing or watering-hole delivery. Net: a real patch-worthy issue for workstations that process untrusted files, but it should be prioritized below any remote/unauthenticated or actively-exploited vulnerability. Note the signals are internally consistent (local vector, user interaction, memory corruption), so no conflict requires vendor verification.

An attacker crafts a malicious image/document (e.g. a booby-trapped PSD, TIFF, or other supported format) and delivers it via email, chat, or a download link to a user who has Photoshop installed. When the victim opens the file, the out-of-bounds write corrupts memory during parsing and the attacker achieves arbitrary code execution as that user. No public exploit code was identified at the time of analysis, so the attacker would need to develop the exploit independently.