EUVD-2026-100689
GHSA-39q8-xc4v-gc6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDeliver crafted malicious file to victim
-
DeliveryVictim opens file in Photoshop
-
ExploitTrigger heap buffer overflow in parser
-
ExecutionExecute arbitrary code as current user
-
ImpactCompromise user data and session
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to open an attacker-supplied malicious file in a vulnerable Photoshop Desktop build (Photoshop ≤27.10 or ≤26.11.7); there is no network-reachable or unattended trigger. The mandatory user-interaction step (UI:R) and local attack vector (AV:L) are the primary limiting factors - the attacker must first deliver the file and socially engineer the user into opening it. Exploitation runs only with the privileges of the user who opens the file (no privilege escalation implied by the vector), so least-privilege accounts constrain the blast radius. No special non-default configuration is indicated; any standard installation that opens the crafted file type is affected. |
| Impact | This is a credible but not emergency-tier priority. The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) reflects local attack vector with required user interaction - it is NOT a remotely-triggerable, wormable flaw. The 'AV:L' plus 'UI:R' combination is the classic signature of a client-side file-parsing bug: the attacker cannot reach the vulnerable code directly over a network and must convince a victim to open a malicious file (e.g., a crafted image). No EPSS score was provided, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC referenced in the input, so there is no evidence of active exploitation or public exploit code. The high confidentiality/integrity/availability impact (C:H/I:H/A:H) is justified because successful exploitation yields arbitrary code execution in the current user's context. Net: a real patch-worthy vulnerability driven by impact and the large install base, but tempered strongly by the user-interaction requirement and absence of any exploitation signal. Prioritize via normal patch cycles for creative/endpoint workstations rather than as a drop-everything incident. |
| Exploit ScenarioDerived | An attacker crafts a malicious image or Photoshop document and delivers it via email, a shared drive, a design-asset download, or a supply-chain/collaboration channel. When the victim opens the file in a vulnerable Photoshop Desktop version, the file parser triggers a heap-based buffer overflow and executes attacker-controlled code with the victim's privileges. No public exploit code is identified at time of analysis, and the local vector plus mandatory user interaction limit scalability. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 contain a heap-based buffer overflow that lets an attacker execute arbitrary code in the context of the user who opens a crafted file. The attack is not network-reachable: it follows the local vector (AV:L) and mandatory user interaction (UI:R), so the attacker must first deliver a malicious file and convince the victim to open it in a vulnerable build; no privileges beyond those of that user are obtained. No public exploit code or confirmed active exploitation was identified at the time of analysis, and the independent assessment rates this as a credible but not emergency-tier priority - the primary risk drivers are the reliability of the heap overflow for code execution and the difficulty of the social-engineering prerequisite rather than any observed campaign.
RemediationAI
Patch availability is indicated per the vendor advisory: Adobe APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html) is the authoritative source for the exact patched build numbers for each affected branch, and no specific fixed version string was present in the input data, so the installed version should be validated against that advisory and upgraded via the Creative Cloud updater or the vendor's direct installer rather than assuming a version number. Until the upgrade is applied, compensate by preventing untrusted documents from reaching the parser: detonate or sandbox incoming image/design files in an email or web gateway before delivery, since that blocks the delivery step but adds processing latency and will not catch files arriving through unmanaged channels such as USB media or chat. Restrict Photoshop use to least-privilege accounts, because exploitation runs only with the privileges of the user who opens the file and this caps the blast radius but does not prevent the overflow. Where operationally feasible, remove or tightly control file-type associations so untrusted documents do not open directly in Photoshop, and rely on endpoint detection tuned to document-parser child-process spawns; both measures reduce exposure but can disrupt legitimate workflows and may generate false positives.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-122, a heap-based buffer overflow, occurring in the file-parsing path Photoshop uses to load user-supplied documents. Untrusted file content is copied into a fixed-size heap buffer without adequate bounds validation, allowing an attacker to overwrite adjacent heap metadata and function pointers, which in a modern memory model is the classic route to controlled code execution under the application's process privileges. The CVSS:3.1 vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H confirms a local attack vector with no privileges required, low attack complexity, and mandatory user interaction, scoped entirely to the vulnerable component (S:U) with high confidentiality, integrity and availability impact. Because the vulnerable path is the document parser rather than any exposed service, exploitation is triggered by opening a malicious file in Photoshop Desktop ≤27.10 or ≤26.11.7; no special non-default configuration, network listener, or elevation step is involved, so any standard installation that opens the crafted file type is affected.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File-parsing RCE: AV:L and UI:R because a user must locally open a malicious file; PR:N as no prior privileges are needed; C/I/A:H from arbitrary code execution as the current user.
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop builds at or below 27.10 and 26.11.7 carry a high-severity heap buffer overflow that allows arbitrary code execution under the privileges of the user who opens a crafted file, and no vendor patch is available yet. The exposure is concentrated in design, marketing, and creative-operations teams whose daily workflow involves opening image files supplied by outside parties, since exploitation requires an attacker to deliver a file and persuade an employee to open it locally. Leadership should treat this as a credible, recurring-risk issue rather than an emergency, prioritizing visibility into where the affected builds are installed and tightening how untrusted creative assets enter the organization.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict or gateway-block untrusted .psd/.psb and related Adobe files entering from email, web, and external file shares; enforce least privilege (standard user accounts) on affected workstations; enable endpoint detection and response plus exploit-protection/attack-surface-reduction rules; disable or sandbox untrusted-content preview and third-party plugin ingestion paths; and require security review of externally supplied creative assets until an Adobe update is published and deployed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB