EUVD-2026-100692
GHSA-gpf8-vcqj-823p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Photoshop file
-
DeliveryDeliver via email or shared asset
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-supplied malicious file in Photoshop Desktop (vulnerable builds: Photoshop ≤27.10 and the 26.x branch ≤26.11.7); this corresponds to AV:L and UI:R - there is no network-triggerable or automatic exploitation path. Limiting factors: the attacker must socially engineer file delivery and the victim must open it, code execution is confined to the current user's privileges (S:U, so no automatic privilege escalation), and only the listed vulnerable version ranges are affected. No special non-default configuration is required beyond running an affected version of the product. |
| Impact | The CVSS 3.1 vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.8 HIGH) is the dominant signal and is internally consistent with the description: AV:L plus UI:R reflects that exploitation is not remote-over-network but requires a victim to locally open a malicious file, which materially lowers real-world risk versus a drive-by network RCE despite the HIGH score. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public POC is referenced, so there is no evidence of active exploitation - treat this as a patch-in-normal-cycle issue for a client application rather than an emergency. The single source is Adobe's own PSIRT advisory (APSB26-158), which is authoritative for affected versions and the fix but provides no independent exploitation telemetry. Note PR:N combined with UI:R: the attacker needs no account on the target but does require social engineering to get the file opened - a meaningful practical barrier that raw CVSS severity obscures. |
| Exploit ScenarioDerived | An attacker crafts a malicious image or project file (e.g., PSD/PSB or other Photoshop-supported format) that triggers an out-of-bounds write when parsed, then delivers it via email, a shared design asset, or a download. When the victim opens the file in a vulnerable Photoshop Desktop build, memory corruption leads to arbitrary code execution in that user's security context. No public exploit code has been identified at time of analysis, so this scenario is inferred from the CWE-787 class and the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
An out-of-bounds write (CWE-787) in Adobe Photoshop Desktop allows an attacker to execute arbitrary code within the context of the current user when a victim opens a specially crafted file. Affected builds are Photoshop 27.x up to and including 27.10 and the older 26.x branch up to and including 26.11.7; the CVSS 3.1 base score is 7.8 (HIGH) with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, meaning the attack is not network-triggerable and depends on the user opening a malicious document, with no confirmed authentication requirement (PR:N). Exploitation is not confirmed as active and there is no public exploit identified at time of analysis, so real-world risk is driven primarily by social-engineering file delivery and the high confidentiality, integrity, and availability impact that a successful memory-corruption primitive carries on the user's machine.
RemediationAI
Apply the fixed Photoshop builds published in Adobe Security Bulletin APSB26-158 (https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html) for the 26.x and 27.x branches; no vendor-released patch version is identified in the data provided here, so the advisory must be consulted to confirm the exact remediated build before closing the finding, and organizations should prioritize upgrades for machines on Photoshop 27.10 or earlier and 26.11.7 or earlier. If immediate patching is not possible, compensating controls are mostly about preventing the malicious file from ever being opened: block untrusted image/document attachments at the email and web gateway and quarantine files from external sources, restrict Photoshop document ingestion to files from trusted internal sources, and consider running Photoshop under a low-privilege, non-admin account or inside an isolated virtual machine/OS sandbox so that any code execution is confined - the trade-off being reduced user convenience and, for sandboxing, potential performance or GPU/plugin compatibility issues. EDR monitoring can help by alerting on Photoshop spawning unexpected child processes (for example cmd.exe, powershell.exe, or script interpreters), which is a strong indicator that the out-of-bounds write has been turned into execution, though such detection is a detective rather than preventive control. File-type allowlisting and disabling automatic preview/thumbnail generation for untrusted documents can reduce exposure further, at the cost of workflow friction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is an out-of-bounds write (CWE-787) in Photoshop Desktop's file-parsing code paths, where crafted input causes the application to write past the bounds of an allocated buffer, corrupting adjacent memory. This is the classic memory-corruption class (also tagged Buffer Overflow / Memory Corruption / RCE) that, when the overwritten data includes pointers or control structures, can be steered into arbitrary code execution. The CVSS vector is internally consistent with this: AV:L and UI:R indicate the trigger is a local file open rather than a remote or network-reachable request, AC:L and PR:N indicate no special conditions or credentials are required once the file is delivered, and S:U means any code execution stays within the privileges of the user running Photoshop, with no automatic privilege escalation. Impact metrics C:H/I:H/A:H reflect that a successful write primitive can compromise the confidentiality, integrity, and availability of data accessible to that user session. Adobe attributes the issue to its own PSIRT (psirt@adobe.com), and ENISA EUVD tracks it as EUVD-2026-100692 with the same two affected version ranges.
Know when Photoshop gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File is opened locally so AV:L; no attacker privileges needed (PR:N) but victim must open a malicious file (UI:R); OOB write yields full code execution as the user (C/I/A:H).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
A memory-corruption flaw in Adobe Photoshop (CVE-2026-96522) lets an attacker run arbitrary code with the privileges of whichever user opens a malicious image or document, exposing the confidentiality, integrity, and availability of that workstation and anything it can reach. Designers, marketers, and any staff using Photoshop 27.x (through 27.10) or 26.x (through 26.11.7) are the primary population at risk, and because delivery depends on tricking a user into opening a crafted file rather than on network exposure, the practical threat is social engineering against creative and content teams. No vendor patch is currently available and no public exploit has been identified, so leadership should treat this as a manageable but unresolved exposure requiring interim controls rather than emergency containment.
No vendor-released patch identified at time of analysis. Interim mitigations: block or sandbox untrusted image and layered document files at email and web gateways; train and remind users not to open Photoshop files from unverified sources; run Photoshop with least privilege and no local admin rights on creative workstations; enforce EDR behavioral detection for Photoshop spawning child processes or making unexpected outbound connections; isolate or virtualize Photoshop for handling externally sourced files; maintain offline/immutable backups of creative assets; limit file-share and network privileges reachable from affected endpoints; monitor Adobe's advisory channel for a fixed version and patch immediately on release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Use-after-free vulnerability in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote atta
Buffer overflow in Adobe Photoshop CS5 12.x before 12.0.5 and CS5.1 12.1.x before 12.1.1 allows remote attackers to exec
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
An issue was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Rated critical severity (CVSS 9.8), t
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds write vulnerability. Rated high sev
Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have an out-of-bounds read vulnerability. Rated high seve
Uncontrolled search path element (DLL hijacking, CWE-427) in Adobe Photoshop Desktop allows arbitrary code execution whe
Adobe Photoshop version 22.1 (and earlier) is affected by a heap buffer overflow vulnerability when handling a specially
Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that c
Heap-based buffer overflow in Adobe Photoshop Desktop allows arbitrary code execution in the context of the current user
Exploit-DB