CVE-2026-82005: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-82005 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that could result in arbitrary code execution in the context of the current user. It affects Photoshop 2025 (versions 26.0 through 26.11.6) and Photoshop 2026 (versions 27.0 through 27.6). The vulnerability was published on September 8, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the application writes data beyond the boundaries of an allocated buffer during file parsing. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a specially crafted malicious file in Photoshop Desktop. The low attack complexity suggests the exploitation technique is straightforward once a malicious file is delivered to the target (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code in the security context of the current user, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files accessible to the user, modify or delete data, or cause the application to crash. If the victim is running Photoshop with elevated privileges, the impact could extend further, though the scope is otherwise unchanged and lateral movement would depend on the user's access level (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.184%, placing it in the 8th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is not automatable, as it requires user interaction to open a malicious file (GitHub Advisory).

1. Craft a malicious file: Create a specially crafted image or Photoshop-compatible file (e.g., PSD, TIFF, or other supported format) that triggers an out-of-bounds write during parsing by exploiting the vulnerable buffer handling code in Photoshop Desktop.
2. Deliver the file to the target: Use social engineering techniques such as phishing emails, malicious downloads, or shared file repositories to convince the victim to obtain the malicious file.
3. Induce the victim to open the file: The attacker must persuade the victim to open the crafted file in Adobe Photoshop Desktop (versions 26.0–26.11.6 or 27.0–27.6).
4. Trigger the out-of-bounds write: When Photoshop parses the malicious file, the vulnerability causes a write operation beyond the intended buffer boundary, corrupting adjacent memory.
5. Achieve code execution: The memory corruption is leveraged to redirect execution flow, resulting in arbitrary code execution in the context of the current user, potentially enabling installation of malware, data exfiltration, or further system compromise (GitHub Advisory).

• Process: Unexpected child processes spawned by the Photoshop Desktop process (e.g., cmd.exe, powershell.exe, bash, curl, or network utilities) following the opening of an untrusted file.
• File System: Presence of unfamiliar or newly created files in user-writable directories (e.g., %APPDATA%, %TEMP%) shortly after opening a Photoshop file from an untrusted source; unexpected modification of Photoshop configuration or plugin files.
• Network: Outbound network connections initiated by the Photoshop process to unknown or suspicious external IP addresses or domains.
• Logs: Application crash logs or Windows Event Logs showing access violations or memory corruption errors originating from Photoshop Desktop around the time a suspicious file was opened.

Adobe has released patched versions addressing this vulnerability: Photoshop 2025 users should update to version 26.11.7 or later, and Photoshop 2026 users should update to version 27.7 or later (Adobe Advisory). No configuration-based workaround is available; updating to the patched version is the recommended remediation. As an interim measure, users should be advised to avoid opening Photoshop files from untrusted or unknown sources, and organizations may consider restricting file access permissions where feasible.

The CIS Security advisory noted that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Tenable published Nessus detection plugins (IDs 343848 and 343849) to identify vulnerable Photoshop installations shortly after disclosure. Coverage was also noted by AusCERT and security aggregators, reflecting standard industry response to an Adobe Patch Tuesday release with no reports of active exploitation.