CVE-2026-96522: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-96522 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that could result in arbitrary code execution in the context of the current user. It affects Photoshop versions up to and including 26.11.7 (2025 release) and up to and including 27.10 (2026 release). The vulnerability was published on October 13, 2026, with a patch advisory referenced as APSB26-158. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), occurring when Photoshop Desktop processes a specially crafted malicious file and writes data beyond the bounds of an allocated buffer. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a malicious file. No technical write-ups or public proof-of-concept code have been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an unauthenticated attacker to execute arbitrary code with the privileges of the user running Photoshop Desktop, resulting in high impact to confidentiality, integrity, and availability. An attacker could read sensitive files, modify data, or cause application crashes on the affected system. The scope is limited to the current user context, with no automatic privilege escalation beyond the running user's permissions (GitHub Advisory).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is 0.0, indicating a very low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering to convince a victim to open a malicious file (GitHub Advisory).

Adobe has released patched versions addressing this vulnerability: Photoshop 26.11.8 (2025 release) and Photoshop 27.11 (2026 release). Users should update to these versions or later via the Creative Cloud desktop application. As an interim measure, users should avoid opening Photoshop files from untrusted or unknown sources, and organizations may consider implementing file reputation or sandboxing solutions for files received externally (Adobe Advisory).