CVE-2026-97312: 
Adobe Photoshop vulnerability analysis and mitigation

CVE-2026-97312 is an out-of-bounds write vulnerability (CWE-787) in Adobe Photoshop Desktop that can result in arbitrary code execution in the context of the current user. It affects Photoshop versions up to and including 26.11.7 (26.x branch) and up to and including 27.10 (27.x branch). The vulnerability was published on October 13, 2026, with a patch made available the same day. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Adobe Advisory).

The vulnerability is classified as CWE-787 (Out-of-bounds Write), meaning the application writes data beyond the boundaries of an allocated buffer during the processing of a crafted file. The attack vector is local, requiring no privileges, but does require user interaction — specifically, a victim must open a malicious file in Photoshop Desktop. The low attack complexity suggests the exploitation technique is straightforward once a suitable malicious file is crafted and delivered to the target (GitHub Advisory, Adobe Advisory).

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the user running Photoshop Desktop, resulting in high impacts to confidentiality, integrity, and availability. An attacker could read sensitive files, modify or destroy data, or cause the application to crash. Since the code executes in the context of the current user, the blast radius is limited to that user's permissions, though it could serve as a foothold for further privilege escalation on the affected system (GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Adobe has released patched versions to address this vulnerability. Users should update Photoshop Desktop to version 26.11.8 or later (for the 26.x branch) or 27.11 or later (for the 27.x branch). As a general precaution, users should avoid opening Photoshop files received from untrusted or unknown sources. Organizations may also consider implementing application allowlisting or restricting Photoshop usage to trusted workflows (Adobe Advisory).