CVE-2024-45108: Adobe Photoshop RCE Vulnerability

CVE-2024-45108 Overview

CVE-2024-45108 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Photoshop Desktop versions 24.7.4, 25.11, and earlier. The flaw allows arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must open a malicious file crafted by an attacker. The vulnerability affects installations on both Microsoft Windows and Apple macOS platforms. Adobe published a security bulletin documenting the issue and released patched versions to address the flaw.

Critical Impact
Attackers can achieve arbitrary code execution on affected Photoshop installations when a user opens a malicious file, leading to full compromise under the current user's privileges.

Affected Products

Adobe Photoshop Desktop 24.7.4 and earlier (24.x branch)
Adobe Photoshop Desktop 25.11 and earlier (25.x branch)
Installations on Microsoft Windows and Apple macOS

Discovery Timeline

2024-09-13 - CVE-2024-45108 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45108

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition [CWE-787] in Adobe Photoshop's file parsing logic. When Photoshop processes a specially crafted image or project file, the application writes data past the bounds of an allocated buffer. This memory corruption can be leveraged to overwrite adjacent memory structures, function pointers, or return addresses. A successful exploit results in arbitrary code execution within the process context of the user running Photoshop. The attack vector is local, requiring the victim to open the malicious file through the application.

Root Cause

The root cause is insufficient bounds validation when parsing untrusted file content. Photoshop supports numerous file formats with complex internal structures such as layered PSD data, embedded resources, and metadata. When a malformed field specifies an out-of-range size or offset, the parser fails to validate the value before writing to memory. This allows attacker-controlled data to be written outside the intended buffer region.

Attack Vector

Exploitation requires social engineering to deliver a malicious file to the victim. Common delivery methods include phishing emails with weaponized attachments, malicious downloads, or files hosted on compromised services. Once opened in a vulnerable Photoshop version, the crafted file triggers the out-of-bounds write during parsing. Code execution occurs at the privilege level of the logged-in user, which is often sufficient for credential theft, lateral movement, or ransomware deployment.

No public proof-of-concept exploit code has been observed for this issue. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Refer to the Adobe Photoshop Security Advisory for vendor-provided technical context.

Detection Methods for CVE-2024-45108

Indicators of Compromise

Photoshop process (Photoshop.exe on Windows, Adobe Photoshop 2024 on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters.
Unexpected outbound network connections initiated by the Photoshop process shortly after a file open event.
Creation of executable files or scripts in user-writable directories immediately following a Photoshop session.
Photoshop crashes or exception events referencing memory access violations when opening received files.

Detection Strategies

Monitor endpoint telemetry for anomalous parent-child process relationships originating from Photoshop.
Correlate file-open events for uncommon or externally sourced PSD, TIFF, or other supported formats with subsequent process or network activity.
Apply behavioral detections for memory corruption artifacts such as heap or stack write violations within the Photoshop process.
Inspect email gateways and web proxies for delivery of Photoshop-compatible file formats from untrusted sources.

Monitoring Recommendations

Enable Adobe application logging and forward it to a centralized SIEM for correlation with endpoint events.
Track installed Photoshop versions across the fleet to identify hosts still running 24.7.4, 25.11, or earlier builds.
Alert on Photoshop processes performing file writes to system directories or startup locations.

How to Mitigate CVE-2024-45108

Immediate Actions Required

Inventory all endpoints with Adobe Photoshop installed and identify versions at or below 24.7.4 and 25.11.
Apply the security updates referenced in Adobe advisory APSB24-72 as a priority for creative and design workstations.
Instruct users to avoid opening Photoshop files received from untrusted sources until patches are deployed.
Restrict execution of Photoshop on high-value or administrative accounts to limit impact of successful exploitation.

Patch Information

Adobe released fixed versions of Photoshop Desktop addressing this vulnerability. Consult the Adobe Photoshop Security Advisory for the exact patched build numbers and update instructions. Use the Adobe Creative Cloud desktop application or enterprise deployment tools to distribute the update.

Workarounds

Configure email and web filtering to block or sandbox Photoshop-compatible file formats from external senders.
Enforce least-privilege on workstations so that Photoshop does not run under administrative accounts.
Enable operating system exploit mitigations such as Windows Exploit Protection or macOS Hardened Runtime for the Photoshop process.
Provide user awareness training focused on phishing lures that deliver design files.

bash

# Windows: query installed Photoshop version via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation