CVE-2026-95641: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-95641 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that could result in arbitrary code execution in the context of the current user. It was published on October 13, 2026, and affects Photoshop versions up to and including 26.11.7 (in the 26.x branch) and up to and including 27.10 (in the 27.x branch). The vulnerability carries a CVSS v3.1 base score of 7.8 (High), classified under CWE-787 (Out-of-bounds Write) (GitHub Advisory, Adobe Advisory).

The vulnerability is rooted in an out-of-bounds write condition (CWE-787), where Photoshop Desktop fails to properly validate buffer boundaries when processing certain file types, allowing data to be written beyond the intended memory buffer. An attacker exploits this by crafting a malicious file that, when opened by a victim in Photoshop, triggers the memory corruption and enables arbitrary code execution. The attack vector is local (the malicious file must be present on the victim's system or delivered via social engineering), requires no privileges, but does require user interaction — specifically, the victim must open the crafted file (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the currently logged-in user, resulting in high impact to confidentiality, integrity, and availability of the affected system. An attacker could read sensitive files, modify or delete data, install malware, or use the compromised session as a foothold for lateral movement within the network. The scope is limited to the current user's context, but on systems where users operate with elevated privileges, the impact could be significantly broader (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction, which somewhat limits opportunistic exploitation, though spear-phishing campaigns delivering malicious Photoshop files remain a realistic attack scenario.

1. Craft a malicious file: An attacker creates a specially crafted image or project file (e.g., a PSD or supported format) that triggers the out-of-bounds write condition when parsed by Photoshop Desktop.
2. Deliver the file to the victim: The attacker distributes the malicious file via phishing email, malicious download link, shared network drive, or other social engineering methods targeting Photoshop users.
3. Victim opens the file: The victim opens the malicious file in a vulnerable version of Adobe Photoshop Desktop (≤26.11.7 or ≤27.10).
4. Trigger memory corruption: Photoshop's file parser writes data beyond the intended buffer boundary, corrupting adjacent memory structures.
5. Achieve code execution: The memory corruption is leveraged to redirect program execution to attacker-controlled code, running with the privileges of the current user (GitHub Advisory, Adobe Advisory).

• Process: Unexpected child processes spawned by the Photoshop process (e.g., cmd.exe, powershell.exe, bash, curl, or network-connecting processes) shortly after opening a file.
• File System: Unexpected files written to user temp directories or Photoshop plugin/scratch directories; new executables or scripts created in user-writable locations following Photoshop file open events.
• Network: Outbound network connections initiated by the Photoshop process (Photoshop.exe) to external or unusual IP addresses, particularly after opening a file from an untrusted source.
• Logs: Application crash logs or Windows Event Logs showing access violation or memory corruption errors in Photoshop around the time of file open events; security logs showing new process creation with Photoshop as the parent process.

Adobe has released patched versions addressing this vulnerability: Photoshop 26.11.8 (for the 26.x branch) and Photoshop 27.11 (for the 27.x branch). Users should update immediately via the Creative Cloud desktop application. As a workaround, users should avoid opening Photoshop files received from untrusted or unknown sources, and organizations should consider implementing file execution policies or sandboxing for file previews (Adobe Advisory, GitHub Advisory).