EUVD-2026-100693
GHSA-hr63-8cvp-46j3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious image file
-
DeliveryDeliver file via email or download
-
ExploitVictim opens file in Photoshop
-
ExecutionTrigger out-of-bounds write in parser
-
ImpactExecute arbitrary code as current user
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the victim to manually open an attacker-supplied malicious file in Photoshop Desktop; this is a client-side, local-vector flaw (AV:L/UI:R) with no network-triggered path and no special product configuration needed beyond a vulnerable installed version (Photoshop ≤27.10 or ≤26.11.7). The principal limiting factors are the mandatory user interaction and the social-engineering effort required to get a target to open the crafted file; code runs only in the current user's security context (S:U), so impact is bounded by that user's privileges rather than escalating system-wide. |
| Impact | This is a genuine but second-tier priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects a classic client-side memory-corruption flaw: the attack vector is LOCAL and requires user interaction (the victim must open a malicious file), which meaningfully lowers real-world urgency compared to a network-reachable, zero-interaction bug. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - this is no public exploit identified at time of analysis. No SSVC decision data was supplied. The signals are internally consistent (local vector, high complexity-of-social-engineering rather than code complexity, full CIA impact on the current-user context), so there is no contradiction to flag. Treat this as a patch-on-normal-cadence item for workstations where Photoshop is installed and users routinely open untrusted PSD/image files, rather than an emergency, absent any indication of in-the-wild use. |
| Exploit ScenarioDerived | An attacker crafts a malicious image/document file that triggers an out-of-bounds write when parsed by Photoshop and delivers it via email, a shared drive, or a download disguised as a legitimate design asset. When the victim opens the file in a vulnerable Photoshop Desktop build, the memory corruption is exploited to execute arbitrary code in the context of the current user. No public exploit code is identified at time of analysis, and the local vector plus required user interaction mean successful attacks depend on social engineering. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Out-of-bounds write in Photoshop Desktop can allow arbitrary code execution in the context of the current user when a victim opens a malicious file; this is a genuine but second-tier priority. Affected versions include Photoshop 27.10 and earlier and 26.11.7 and earlier per EUVD. No public exploit identified at time of analysis, and exploitation requires the victim to manually open an attacker-supplied file (AV:L/UI:R/PR:N).
RemediationAI
Patch available per vendor advisory: consult Adobe APSB26-158 at https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html for the exact fixed Photoshop build and upgrade to that version; no independent fixed version number is provided in the input. If immediate patching is not possible, reduce risk by preventing users from opening untrusted Photoshop or image files from unknown sources, blocking risky file types at email and web gateways, using endpoint detection and sandboxing for suspicious files, and running Photoshop as a standard user so code execution is bounded by the user's privileges. These are compensating controls with workflow and usability trade-offs and are not a substitute for the vendor update.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CVE-2026-96521 is a memory-corruption issue in Adobe Photoshop Desktop, classified as CWE-787 (out-of-bounds write). The root cause is insufficient bounds validation while processing file data, so a crafted file can trigger writes outside intended memory and potentially redirect execution to attacker-controlled code. The CVSS:3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a local attack with low complexity, no prior authentication per PR:N, mandatory user interaction to open the malicious file, and impact scoped to the current user's security context. EUVD lists affected version ranges as Photoshop 0 ≤27.10 and Photoshop 0 ≤26.11.7; no CPE strings were provided. The RCE, Buffer Overflow, and Memory Corruption tags are consistent with this CWE class. Vendor advisory: Adobe APSB26-158.
Know when Adobe gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
File must be opened locally so AV:L and UI:R; no prior auth needed (PR:N); out-of-bounds write yields code execution with full C/I/A impact in the current-user context (S:U).
Primary rating from Vendor (adobe).
CVSS VectorVendor: adobe
DescriptionCVE.org
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Executive ViewAI
Adobe Photoshop Desktop versions 27.10 and earlier and 26.11.7 and earlier contain an out-of-bounds write that can let a malicious file run code under the signed-in user's own account the moment that file is opened. Because Photoshop is a standard tool across design, marketing, and content teams, the realistic exposure runs through file sharing and email attachments rather than any network-facing service, making everyday creative workflows the primary attack path. There is no vendor patch at this time, so leadership should treat this as a user-behavior and content-handling risk to be actively managed rather than a routine update item.
No vendor-released patch identified at time of analysis. Interim mitigations: enforce user awareness and a policy of not opening unsolicited or externally sourced image files; block or sandbox inbound Adobe image file formats (PSD, PSB, and related) at email and web gateways; disable or restrict preview handlers and file-association auto-open behavior for untrusted locations; run affected applications with standard user privileges rather than administrative rights to limit code execution impact; rely on EDR/antivirus behavioral detection and application allowlisting; and restrict the population of endpoints running affected Photoshop versions where business use permits.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Remote code execution in Adobe Flash Player 11.x through 18.x allows unauthenticated network attackers to execute arbitr
Remote code execution in Adobe Flash Player 21.0.0.226 and earlier allows unauthenticated network attackers to execute a
Adobe Flash Player contains a heap-based buffer overflow that allows remote code execution, exploited as a zero-day in J
Adobe Reader and Acrobat contain an unspecified U3D component vulnerability causing memory corruption that allows remote
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute ar
Adobe Reader and Acrobat 9.x, 8.x, and 7.x contain a stack-based buffer overflow in the getIcon method of the Collab obj
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Ma
Adobe Reader and Acrobat contain a use-after-free vulnerability in the Doc.media.newPlayer JavaScript method that was ac
Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player
Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Window
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and pos
Exploit-DB