Photoshop Mobile EUVD-2026-73925

The attacker must be low-privileged (PR:L per CVSS) - able to place or deliver a crafted file that the victim can open. The victim must actively open the malicious Photoshop document file in Adobe Photoshop Mobile for Android (UI:R). The attack vector is local (AV:L), meaning the crafted file must be accessible on the device rather than delivered directly over the network. High attack complexity (AC:H) means conditions beyond the attacker's control must be met - likely specific filesystem paths, Android permission grants, or app state. Only Photoshop Android ≤1.6.0.2294 and ≤1.6.0.2299 are confirmed affected; updated versions are outside scope. The CVSS C:N metric indicates confidentiality impact is either absent or unconfirmed despite the description referencing unauthorized file access - defenders should treat file-read scope as uncertain pending vendor clarification.

The real-world risk of this vulnerability is moderate and further reduced by several concrete limiting factors. The CVSS 3.1 base score of 5.0 (AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:H) captures the local-only attack surface, the requirement for both low-privileged access and user interaction, and high complexity meaning conditions outside the attacker's control must align. SSVC signals reinforce this: exploitation status is 'none,' the attack is not automatable, and technical impact is only 'partial.' The EPSS score was not provided, consistent with the absence of any known weaponization. The high availability impact (A:H) is the most notable severity element and likely reflects the ability to overwrite or corrupt files critical to app function or Android OS integrity outside the sandbox. There is a notable discrepancy worth flagging: the description explicitly states the vulnerability allows 'access [to] unauthorized files or directories outside the intended restrictions,' which would typically imply at least C:L in a CVSS vector, yet the provided vector reads C:N - defenders should verify the actual confidentiality scope with Adobe's APSB26-136 advisory directly before scoping incident response. Overall, this is a genuine but low-urgency finding: the delivery chain (attacker places file, victim opens it, complexity conditions align) significantly reduces the realistic attack surface compared to a network-exploitable flaw.

An attacker crafts a malicious Photoshop document embedding path traversal sequences in embedded asset references or export path fields, then delivers it to a target via email, messaging, or a compromised file share. When the victim opens the document in Adobe Photoshop Mobile on Android, the unvalidated path allows reads of files outside the app's intended directory or overwrites of files that cause high availability impact. High attack complexity means the attacker may also need specific device conditions - such as particular Android version, filesystem layout, or permission state - to align for the traversal to reach the target path.