CVE-2024-43756: Adobe Photoshop RCE Vulnerability

CVE-2024-43756 Overview

CVE-2024-43756 is a heap-based buffer overflow vulnerability affecting Adobe Photoshop Desktop versions 24.7.4, 25.11, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a maliciously crafted file. Exploitation requires user interaction, limiting large-scale automated attacks but keeping targeted phishing and supply-chain scenarios viable. Adobe published a security advisory (APSB24-72) addressing the issue across Windows and macOS installations. The vulnerability is categorized under [CWE-122] Heap-based Buffer Overflow and [CWE-119] Improper Restriction of Operations within the Bounds of a Memory Buffer.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-in Photoshop user, potentially enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Photoshop Desktop 24.7.4 and earlier
Adobe Photoshop Desktop 25.11 and earlier
Windows and macOS installations of the affected Photoshop versions

Discovery Timeline

2024-09-13 - CVE-2024-43756 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43756

Vulnerability Analysis

The vulnerability resides in Photoshop's file parsing logic, where malformed input triggers a heap-based buffer overflow. When Photoshop processes a crafted image or project file, the application writes data beyond the bounds of an allocated heap buffer. This overflow corrupts adjacent heap metadata or object pointers, giving an attacker the primitives needed to hijack control flow.

Because Photoshop typically runs with standard user privileges, code execution occurs in the security context of the current user. Attackers commonly chain such flaws with privilege escalation vulnerabilities to reach SYSTEM or root. The requirement for user interaction shifts the attack surface toward social engineering, malicious email attachments, and compromised design asset repositories.

Root Cause

The root cause is improper bounds checking during the parsing of an image or asset file format supported by Photoshop. The application allocates a heap buffer based on values contained in the untrusted file, then copies data into that buffer without validating that the source length fits within the destination allocation. This mismatch produces the heap overflow condition described by [CWE-122] and [CWE-119].

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious file, delivers it through email, a shared drive, a design collaboration platform, or a compromised website, and convinces the victim to open it with a vulnerable Photoshop version. Once opened, the parser triggers the overflow and the attacker's payload executes without additional prompts.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-43756

Indicators of Compromise

Unexpected Photoshop process crashes or Windows Error Reporting (WER) entries referencing Photoshop.exe heap corruption.
Photoshop spawning unusual child processes such as cmd.exe, powershell.exe, or bash shortly after opening a file.
Outbound network connections initiated by Photoshop.exe to unfamiliar domains or IP addresses.
Creation of executable files, scheduled tasks, or LaunchAgents by the Photoshop process.

Detection Strategies

Hunt for anomalous process lineage where Photoshop.exe is the parent of scripting or shell interpreters.
Alert on Photoshop writing to autostart locations, Startup folders, or macOS LaunchAgents and LaunchDaemons directories.
Correlate Photoshop crash telemetry with subsequent file writes or network activity from the same user session.
Inspect opened files from untrusted sources such as email attachments or browser downloads for known-malicious signatures.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized SIEM or data lake for correlation across hosts running Photoshop.
Enable exploit protection and Data Execution Prevention (DEP) telemetry to catch memory corruption attempts.
Track Photoshop version inventory across the fleet to identify hosts still running 24.7.4, 25.11, or earlier.
Monitor design collaboration platforms and shared storage for unusual uploads of .psd, .psb, and related asset files from untrusted accounts.

How to Mitigate CVE-2024-43756

Immediate Actions Required

Update Adobe Photoshop to the fixed versions listed in Adobe advisory APSB24-72 on all Windows and macOS endpoints.
Inventory endpoints running Photoshop 24.7.4, 25.11, or earlier and prioritize them for patching.
Restrict opening of Photoshop files received from untrusted sources until patching completes.
Enforce least-privilege user accounts so that successful exploitation cannot escalate directly to administrative rights.

Patch Information

Adobe released security updates addressing CVE-2024-43756 in the Adobe Photoshop Security Advisory APSB24-72. Administrators should apply the vendor-supplied updates through the Adobe Creative Cloud desktop application or managed software deployment tooling.

Workarounds

Block or quarantine Photoshop file types received from external email senders at the mail gateway.
Use application allowlisting to restrict which locations Photoshop can load files from.
Enable operating system exploit mitigations such as Windows Exploit Guard and macOS Hardened Runtime protections.
Train users to avoid opening unsolicited design files and to verify sender identity before opening attachments.

bash

# Query installed Photoshop version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | \
  Where-Object { $_.DisplayName -like "*Photoshop*" } | \
  Select-Object DisplayName, DisplayVersion, Publisher

# Query installed Photoshop version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2024/Adobe Photoshop 2024.app"