Adobe Photoshop EUVD-2026-100686

Exploitation requires the victim to open an attacker-supplied malicious file in Photoshop Desktop (UI:R), and succeeds against default configurations of affected versions (Photoshop ≤26.11.7 and ≤27.10) - no special feature or non-default setting is called out in the description. Limiting factors: the attack vector is local (AV:L), so the attacker must deliver the file and rely on social engineering to get it opened; there is no network-remote or zero-click path, no elevated privileges are gained beyond the current user's context (S:U), and the required user interaction materially reduces the viability of large-scale automated exploitation.

The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 High) characterizes this as a local, low-complexity, unauthenticated-but-user-interaction-dependent out-of-bounds write (CWE-787) yielding full confidentiality, integrity, and availability impact in the context of the current user. The AV:L designation is consistent with the description: exploitation is not network-reachable on its own but requires a victim to open a malicious file, so this is a client-side file-parsing bug rather than a remotely triggerable service flaw. No EPSS score was supplied in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public proof-of-concept was provided, so exploitation status is 'no public exploit identified at time of analysis.' This profile - a memory-corruption RCE in a widely used creative application, reported through Adobe PSIRT and patched via an Adobe advisory - represents a credible but not emergency priority: the user-interaction requirement and local attack vector meaningfully constrain mass exploitation, making targeted social-engineering (malicious document delivery) the realistic threat model rather than automated worming. There is no conflict between the CVSS vector and the description; both agree on local, user-interaction-gated execution.

An attacker crafts a malicious image or project file (e.g. a PSD or other Photoshop-supported format) that triggers the out-of-bounds write when parsed, and delivers it via email, a shared drive, or a download link. When the victim opens the file in a vulnerable Photoshop Desktop build, the corruption is triggered and arbitrary code executes with the privileges of the current user. No public exploit code was identified in the provided intelligence, so this scenario is based on the vulnerability class and CVSS vector rather than a confirmed POC.