CVE-2026-96521: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-96521 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that could allow arbitrary code execution in the context of the current user. It affects Photoshop versions up to and including 27.10 (patched in 27.11) and versions up to and including 26.11.7 (patched in 26.11.8). The vulnerability was published on October 13, 2026, with Adobe's security advisory APSB26-158 and a corresponding GitHub Advisory (GHSA-hr63-8cvp-46j3). It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning Photoshop writes data beyond the boundaries of an allocated buffer when processing certain file types. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a specially crafted malicious file. The low attack complexity suggests the exploitation technique is straightforward once a suitable malicious file is constructed and delivered to the target (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Photoshop Desktop, resulting in high impacts to confidentiality, integrity, and availability. An attacker could read sensitive files, modify data, install malware, or crash the application. Because execution occurs in the context of the current user, the blast radius is limited to that user's permissions, though it could serve as a foothold for further privilege escalation (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to convince a user to open a malicious file, which raises the practical barrier for attackers.

1. Craft a malicious file: Create a specially crafted image or Photoshop-compatible file (e.g., PSD, PSB, or supported format) that triggers the out-of-bounds write condition in vulnerable Photoshop versions (≤27.10 or ≤26.11.7).
2. Deliver the file to the target: Use social engineering techniques such as phishing emails, malicious downloads, or shared cloud storage to deliver the crafted file to a victim running a vulnerable version of Photoshop Desktop.
3. Induce the victim to open the file: Convince the target to open the malicious file in Photoshop Desktop. No elevated privileges or authentication are required on the attacker's part.
4. Trigger the out-of-bounds write: Upon opening the file, Photoshop processes the malformed data, causing a write operation beyond the intended buffer boundary (CWE-787), corrupting adjacent memory.
5. Achieve arbitrary code execution: The memory corruption is leveraged to redirect execution flow, resulting in arbitrary code running in the context of the current user's session (GitHub Advisory, Adobe Advisory).

• Process: Unexpected child processes spawned by the Photoshop Desktop process (e.g., cmd.exe, powershell.exe, bash, curl, or other shells/utilities not normally associated with Photoshop).
• File System: Presence of unusual or newly created files in the user's temp directory, Photoshop installation directory, or startup folders shortly after opening a Photoshop file from an untrusted source.
• Logs: Application crash logs or Windows Event Logs (Event ID 1000/1001) referencing Photoshop with memory access violations or abnormal termination around the time a suspicious file was opened.
• Network: Unexpected outbound network connections originating from the Photoshop process to external IP addresses or domains, which may indicate post-exploitation activity such as a reverse shell or data exfiltration.

Adobe has released patched versions addressing this vulnerability: Photoshop 27.11 (for the 27.x branch) and Photoshop 26.11.8 (for the 26.x branch). Users should update Photoshop Desktop to one of these versions or later via the Creative Cloud desktop application. As a precautionary measure, users should avoid opening Photoshop files received from untrusted or unknown sources until the patch is applied (Adobe Advisory, GitHub Advisory).