EUVD-2026-100688
GHSA-qcmf-p6fp-qwcp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver malicious crafted file to victim
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in a vulnerable Photoshop Desktop build (≤26.11.7 or ≤27.10); the out-of-bounds write is triggered during file parsing and yields code execution only in the context of the current user. Limiting factors: mandatory user interaction (UI:R - the file must be opened by the victim), a local/file-based delivery vector (AV:L, not remotely network-reachable without social engineering), and no privilege escalation (code runs as the current user, not SYSTEM/root). No special product configuration is required - default installations are affected - so the primary gate is convincing the user to open the crafted file. |
| Impact | This is a CVSS 7.8 (High) memory-corruption flaw (CWE-787 out-of-bounds write) in Adobe Photoshop Desktop. The CVSS vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows a local attack vector requiring user interaction but no privileges, with full confidentiality, integrity, and availability impact - consistent with an open-malicious-file code-execution bug running in the context of the current user. Mitigating the raw score: there is no CISA KEV listing (not confirmed actively exploited), no public exploit or POC referenced in the available data, and no EPSS/SSVC values were provided, so exploitation probability cannot be quantified from this input. The requirement for user interaction (victim must open a crafted file) and the local/file-based vector (AV:L) meaningfully lower real-world risk versus a remote unauthenticated network bug of the same score. Net assessment: a credible, patch-worthy desktop client-side RCE typical of the Adobe PSIRT patch cycle, but - absent KEV, POC, or EPSS signals - it is a routine-priority fix rather than an emergency, best handled through normal creative-suite patch management. No conflicting signals were detected in the provided data; the main gap is the absence of EPSS, SSVC, KEV, and POC telemetry. |
| Exploit ScenarioDerived | An attacker crafts a malicious image or Photoshop document (e.g., delivered via email, download, or a shared asset library) that triggers the out-of-bounds write when parsed. A victim with a vulnerable Photoshop version (≤26.11.7 or ≤27.10) opens the file, and the attacker achieves arbitrary code execution in the context of that user. No public POC or exploit code is identified in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user when a victim opens an attacker-supplied file in a vulnerable build - Photoshop 26.11.7 and earlier in the 26.x line, or 27.10 and earlier in the 27.x line. Adobe rates this CVSS 7.8 (High) with a local attack vector (AV:L), no privileges required (PR:N), and mandatory user interaction (UI:R); because the scope is unchanged (S:U), any code that executes runs with the victim's own rights rather than escalating to SYSTEM or root. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the flaw is not listed in CISA KEV; the practical barrier to exploitation is convincing a user to open a crafted file, and default installations are affected with no special configuration required.
RemediationAI
Patch availability is per the vendor's security bulletin - apply the fixed Photoshop build released for APSB26-158, which supersedes the affected ranges of 26.11.7 and earlier (26.x line) and 27.10 and earlier (27.x line); confirm the exact fixed build number in the advisory at https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html and via the Creative Cloud updater, since the exact patched version could not be independently confirmed from the supplied data. Until every affected seat is updated, use compensating controls that target the file-open prerequisite: block Photoshop document and image formats from untrusted sources at the mail and web gateways, and instruct users not to open files from unknown senders - the trade-off is reduced business agility and possible blocking of legitimate artwork. If the file format is not needed by most staff, removing the file-type association with Photoshop or restricting handling of documents to a dedicated review workstation with a low-privilege account limits the impact of a successful trigger, since code runs only as the current user; the trade-off is operational overhead and a separate review step. Disabling OS-level thumbnail and preview handlers for Photoshop formats reduces accidental parsing outside the application but may break File Explorer or Finder previews. Running Photoshop as a standard, non-administrative user and using EDR with memory-corruption and exploit-mitigation detections does not fix the flaw but constrains post-exploitation reach and can surface a successful trigger; the trade-off is some loss of user convenience and dependence on endpoint sensor quality.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is a CWE-787 out-of-bounds write occurring while Photoshop parses a document supplied by the attacker, which is consistent with the RCE, Buffer Overflow and Memory Corruption tags attached to this record. A parser writes past the bounds of a heap or stack buffer into adjacent memory; a carefully crafted file can therefore corrupt neighbouring data structures and, in a memory-corruption exploitation chain, redirect execution to attacker-controlled code inside the Photoshop process. The CVSS 3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H describes the resulting risk profile precisely: delivery is local/file-based rather than network-reachable, no authentication or credentials are needed, but the victim must actively open the malicious file. The unchanged scope (S:U) confirms the payload executes only within the privileges of the current user session, so the blast radius is the user's files, credentials and network context rather than the whole operating system. The assessment and the vendor's own severity rating agree on both the vector and the impact; the affected version set is defined by Adobe's bulletin (APSB26-158) and the ENISA EUVD record EUVD-2026-100688 rather than by explicit CPE strings, so version ranges should be treated as the authoritative scope indicator for this advisory. No special product configuration, plug-in or component is required - the vulnerable parsing path is reachable in a default install simply by opening the crafted document.
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally by the victim so AV:L and UI:R; no prior privileges needed (PR:N); memory-corruption RCE in user context gives full C/I/A impact with unchanged scope.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop, a critical tool for many creative and marketing teams, suffers from a high-severity vulnerability that could let an attacker run malicious code with the victim's user rights by opening a crafted file. With no public exploit identified at time of analysis, the immediate risk is limited but the absence of a vendor patch leaves organizations exposed to potential targeted attacks. Leadership should ensure that creative and design staff are aware of the risk and that interim controls are implemented to prevent file-based compromise.
No vendor-released patch identified at time of analysis. Interim mitigations include: block untrusted files at email and web gateways; disable file preview handlers; apply application allowlisting; enforce least privilege; conduct user awareness training; and monitor for anomalous process or file activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Exploit-DB