CVE-2024-43760: Adobe Photoshop RCE Vulnerability

CVE-2024-43760 Overview

CVE-2024-43760 is an out-of-bounds write vulnerability affecting Adobe Photoshop Desktop versions 24.7.4, 25.11, and earlier. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious file. The vulnerability is classified under CWE-787 and impacts both Windows and macOS installations of Photoshop. Exploitation requires user interaction, limiting mass exploitation but leaving targeted users, designers, and enterprise creative teams exposed to code execution attacks via malicious image files.

Critical Impact
Successful exploitation results in arbitrary code execution with the privileges of the logged-in user, enabling attackers to install malware, exfiltrate data, or pivot laterally within enterprise environments.

Affected Products

Adobe Photoshop Desktop 24.7.4 and earlier (2023 release track)
Adobe Photoshop Desktop 25.11 and earlier (2024 release track)
Photoshop installations on Microsoft Windows and Apple macOS

Discovery Timeline

2024-09-13 - CVE-2024-43760 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-43760

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition within Adobe Photoshop's file parsing logic. When Photoshop processes a specially crafted image or project file, the application writes data beyond the boundaries of an allocated memory buffer. This memory corruption can overwrite adjacent structures, including function pointers or heap metadata used by the process.

Attackers who control the out-of-bounds write can steer program execution toward attacker-supplied code. Because Photoshop runs with the user's privileges, successful exploitation yields code execution at that privilege level. In enterprise environments where designers hold access to sensitive intellectual property or shared network resources, this becomes an effective initial access vector.

The attack vector is local, meaning the malicious file must reach the victim's system. Common delivery channels include email attachments, shared drives, cloud storage synchronization, and drive-by downloads from compromised design asset repositories.

Root Cause

The root cause is insufficient bounds checking during the parsing of file format structures. Photoshop supports a wide array of image formats, and malformed length fields or chunk sizes in a crafted file cause the parser to write past the intended buffer boundary. Adobe's advisory APSB24-72 addresses the flaw but does not publicly detail the specific format or parsing routine involved.

Attack Vector

Exploitation follows a predictable pattern for client-side memory corruption. The attacker crafts a malicious file targeting the vulnerable parser and delivers it to a Photoshop user. When the user opens the file, the out-of-bounds write triggers, and the payload executes in the Photoshop process context. No authentication or network access to the victim system is required beyond delivering the file.

See the Adobe Security Advisory APSB24-72 for vendor guidance. No public proof-of-concept exploit or CISA KEV listing exists for this CVE at the time of writing.

Detection Methods for CVE-2024-43760

Indicators of Compromise

Unexpected child processes spawned by Photoshop.exe on Windows or Adobe Photoshop 2024 on macOS, particularly command interpreters like cmd.exe, powershell.exe, or /bin/sh.
Photoshop process crashes with access violation exceptions correlated with recently opened files from untrusted sources.
Photoshop making outbound network connections to non-Adobe infrastructure shortly after opening a file.
Creation of executable files or scripts in user-writable paths by the Photoshop process.

Detection Strategies

Deploy endpoint behavioral monitoring to flag anomalous child process creation from creative applications, which rarely spawn shells or scripting hosts under normal use.
Correlate file-open telemetry from Photoshop with subsequent process, file, and network activity to detect exploitation chains originating from a single malicious document.
Hunt for Photoshop process memory anomalies and crashes using Windows Error Reporting or macOS crash logs as leading indicators of exploit attempts.

Monitoring Recommendations

Inventory all Photoshop installations across managed endpoints and confirm build versions against Adobe's patched releases.
Log and alert on Photoshop opening files from browser download folders, email attachment paths, or removable media locations.
Track outbound network connections initiated by Photoshop processes to non-Adobe destinations, which are unusual for standard workflows.

How to Mitigate CVE-2024-43760

Immediate Actions Required

Update Adobe Photoshop to the fixed versions published in Adobe advisory APSB24-72 on all Windows and macOS endpoints.
Verify version compliance across the fleet, prioritizing endpoints handling files from external clients, vendors, or public repositories.
Restrict Photoshop from opening files sourced from untrusted email attachments or web downloads until patching is complete.

Patch Information

Adobe released fixed builds addressing this vulnerability. Refer to the Adobe Security Advisory APSB24-72 for the specific patched versions and download instructions through Adobe Creative Cloud. Enterprise administrators should push updates via the Adobe Admin Console or their standard software distribution tooling.

Workarounds

Configure application control policies to block Photoshop from executing child processes such as cmd.exe, powershell.exe, wscript.exe, and shell binaries on macOS.
Enforce user training that discourages opening .psd, .psb, or other Photoshop-parseable files received from untrusted sources.
Isolate creative workstations from sensitive network segments and apply least-privilege principles to reduce the blast radius of user-context code execution.

bash

# Verify installed Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate

# Verify installed Photoshop version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2024/Adobe Photoshop 2024.app"