CVE-2026-82006: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-82006 is a Heap-based Buffer Overflow vulnerability (CWE-122) in Adobe Photoshop Desktop that could allow arbitrary code execution in the context of the current user. It affects Photoshop 2025 versions up to and including 26.11.6, and Photoshop 2026 versions up to and including 27.6. The vulnerability was published on September 8, 2026, with patches made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-122 (Heap-based Buffer Overflow), where a buffer allocated in the heap portion of memory can be overwritten due to insufficient bounds checking during file parsing. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a specially crafted malicious file in Photoshop Desktop. The overflow condition can corrupt heap memory in a way that enables an attacker to redirect code execution, potentially achieving full control over the application process (GitHub Advisory, Adobe Advisory).

Successful exploitation results in arbitrary code execution in the context of the currently logged-in user, with high impact to confidentiality, integrity, and availability. An attacker who tricks a user into opening a malicious file could gain full control of the Photoshop process, access sensitive files accessible to that user, install malware, or use the compromised session as a foothold for further lateral movement within the environment. The scope is unchanged, meaning the impact is contained to the vulnerable component's security context (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time, as confirmed by NVD SSVC data indicating exploitation status as "none" and the attack is not automatable (GitHub Advisory). The EPSS score is approximately 0.248%, placing it in the 16th percentile for exploitation likelihood within the next 30 days. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Craft a malicious file: An attacker creates a specially crafted file (e.g., a malformed image or Photoshop-compatible document) designed to trigger a heap-based buffer overflow when parsed by Adobe Photoshop Desktop.
2. Deliver the file: The attacker distributes the malicious file via phishing email, malicious download link, shared network drive, or social engineering, targeting users with vulnerable versions of Photoshop 2025 (≤26.11.6) or Photoshop 2026 (≤27.6).
3. Induce user interaction: The attacker convinces the victim to open the malicious file in Photoshop Desktop — for example, by disguising it as a legitimate design asset or project file.
4. Trigger the overflow: Upon opening, Photoshop's file parser processes the malformed data, causing a heap buffer overflow that corrupts adjacent memory structures.
5. Achieve code execution: The attacker's crafted payload leverages the memory corruption to redirect execution flow, running arbitrary code in the context of the current user account, potentially enabling persistence, data theft, or further system compromise (GitHub Advisory, Adobe Advisory).

• Process: Unexpected child processes spawned by the Photoshop Desktop process (e.g., cmd.exe, powershell.exe, bash, curl, or other shells/utilities not normally associated with Photoshop).
• File System: Unusual files written to the user's temp directory or Photoshop installation directory shortly after opening a file; unexpected scripts or executables created by the Photoshop process.
• Network: Outbound network connections initiated by the Photoshop process to unknown or suspicious external IP addresses or domains, particularly after opening a file from an untrusted source.
• Logs: Application crash logs or Windows Error Reporting entries referencing heap corruption or access violations within Photoshop; security event logs showing new process creation under the Photoshop parent process.

Adobe has released patched versions addressing this vulnerability: Photoshop 2025 users should update to version 26.11.7 or later, and Photoshop 2026 users should update to version 27.7 or later. Users should apply updates via the Creative Cloud desktop application or Adobe's update mechanism as soon as possible. As a general precaution, users should avoid opening Photoshop files received from untrusted or unknown sources (Adobe Advisory, GitHub Advisory).

The CIS (Center for Internet Security) issued an advisory noting that multiple vulnerabilities in Adobe products, including this one, could allow for arbitrary code execution, recommending prompt patching (CIS Advisory). Tenable published Nessus detection plugins (IDs 343848 and 343849) to identify vulnerable Photoshop installations. Coverage was also noted by security aggregators such as BeyondMachines and meterpreter.org in the context of Adobe's September 2026 patch cycle.