CVE-2026-96523: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-96523 is an out-of-bounds write vulnerability in Adobe Photoshop Desktop that could result in arbitrary code execution in the context of the current user. It affects Photoshop versions up to and including 27.10 (fixed in 27.11) and versions up to and including 26.11.7 (fixed in 26.11.8). The vulnerability was published on October 13, 2026, with an Adobe security advisory (APSB26-158) and a corresponding GitHub Advisory (GHSA-qcmf-p6fp-qwcp). It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), occurring when Photoshop Desktop processes a specially crafted malicious file and writes data beyond the bounds of an intended buffer. The attack vector is local, requiring no privileges but necessitating user interaction — specifically, a victim must be socially engineered into opening a malicious file. The low attack complexity suggests the exploitation technique is straightforward once a suitable malicious file is crafted. No public technical write-ups or proof-of-concept code have been identified at this time (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user running Photoshop Desktop, resulting in high confidentiality, integrity, and availability impact. An attacker could read sensitive files, modify data, or cause application crashes on the affected system. The scope is unchanged, meaning the impact is confined to the user's session context, but could still enable further lateral movement if the compromised account has elevated privileges (GitHub Advisory).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Adobe has released patched versions addressing this vulnerability: Photoshop 27.11 (for the 27.x branch) and Photoshop 26.11.8 (for the 26.x branch). Users should update Photoshop Desktop to one of these versions via the Creative Cloud desktop application as soon as possible. As a general precaution, users should avoid opening Photoshop files received from untrusted or unknown sources (Adobe Advisory, GitHub Advisory).