CVE-2024-34117: Adobe Photoshop RCE Vulnerability

CVE-2024-34117 Overview

CVE-2024-34117 is a Use After Free vulnerability [CWE-416] affecting Adobe Photoshop Desktop versions 24.7.3, 25.9.1, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a malicious file. Adobe published security bulletin APSB24-49 addressing the issue across supported Photoshop installations on Windows and macOS.

The vulnerability requires user interaction, limiting mass exploitation but making it viable for targeted attacks that leverage social engineering. Attackers can weaponize crafted image or project files distributed through email, shared drives, or download portals.

Critical Impact
Successful exploitation grants arbitrary code execution with the privileges of the logged-in user, enabling data theft, persistence, and lateral movement from creative workstations.

Affected Products

Adobe Photoshop Desktop 24.7.3 and earlier (24.x branch)
Adobe Photoshop Desktop 25.9.1 and earlier (25.x branch)
Installations on Microsoft Windows and Apple macOS

Discovery Timeline

2024-08-14 - CVE-2024-34117 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34117

Vulnerability Analysis

The vulnerability is a Use After Free condition in Adobe Photoshop's file parsing logic. Photoshop frees a memory object during processing of a crafted file and later accesses the dangling pointer. Attackers control the freed region by grooming the heap, allowing them to redirect execution to attacker-supplied data.

Exploitation delivers arbitrary code execution in the context of the user running Photoshop. On creative and engineering workstations, this often includes access to source assets, cloud storage tokens, and cached credentials. The attack requires local file access, meaning the victim must open the crafted file within Photoshop.

The issue impacts both Windows and macOS builds because the vulnerable parsing code is shared across platforms. Adobe classified the issue as priority 3 in bulletin APSB24-49, indicating no known active exploitation at release.

Root Cause

The root cause is improper object lifetime management [CWE-416]. Photoshop releases a heap object while retaining a reference that is later dereferenced during subsequent parsing steps. Reuse of that memory by attacker-controlled data leads to type confusion and control-flow hijack primitives.

Attack Vector

The attack vector is local with required user interaction. An attacker crafts a malicious Photoshop-compatible file and delivers it through phishing, watering hole sites, or supply chain compromise of shared design assets. Opening the file in a vulnerable Photoshop build triggers the Use After Free and executes attacker code.

No verified public exploit code exists for CVE-2024-34117. Refer to the Adobe Photoshop Security Advisory for vendor technical guidance.

Detection Methods for CVE-2024-34117

Indicators of Compromise

Photoshop process (Photoshop.exe on Windows, Adobe Photoshop 2024 on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, bash, or osascript
Photoshop initiating outbound network connections to unfamiliar domains shortly after opening a file
Unexpected file writes to startup, LaunchAgents, or scheduled task locations originating from the Photoshop process
Crashes or exception events in Photoshop coinciding with opening files received from external sources

Detection Strategies

Alert on parent-child process anomalies where Adobe Photoshop launches interpreters, shells, or living-off-the-land binaries
Correlate Photoshop crashes with subsequent process creation or persistence artifacts on the same host
Monitor for suspicious document opens from browser download directories or email attachment cache paths

Monitoring Recommendations

Enable process creation and image load telemetry on endpoints running Adobe Creative Cloud applications
Collect and centralize Windows Event Log ID 4688 and macOS ExecEvent telemetry for design workstations
Track Photoshop version inventory to identify hosts running 24.7.3, 25.9.1, or earlier builds

How to Mitigate CVE-2024-34117

Immediate Actions Required

Update Adobe Photoshop to version 24.7.4 or 25.9.2 (or later) as specified in Adobe bulletin APSB24-49
Inventory all workstations running Adobe Photoshop and prioritize patching for users who handle external files
Instruct users to avoid opening Photoshop files received from untrusted sources until patching completes

Patch Information

Adobe released fixed builds through the Creative Cloud desktop application. Administrators should consult the Adobe Photoshop Security Advisory for exact fixed version numbers and deployment guidance. Enterprise deployments can use the Adobe Admin Console or Remote Update Manager to push updates.

Workarounds

Restrict Photoshop file handling to files from trusted internal sources until patches are applied
Apply application allowlisting to prevent Photoshop from spawning shells or scripting interpreters
Run Photoshop under standard user accounts rather than administrative accounts to limit post-exploitation impact

bash

# Query installed Photoshop version on Windows
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s /v ApplicationVersion

# Query installed Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2024/Adobe Photoshop 2024.app/Contents/Info.plist" CFBundleShortVersionString