CVE-2024-45109: Adobe Photoshop RCE Vulnerability

CVE-2024-45109 Overview

CVE-2024-45109 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Photoshop Desktop versions 24.7.4, 25.11, and earlier on Windows and macOS. Successful exploitation allows arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file crafted by an attacker. Adobe published the security advisory on September 10, 2024, and the CVE was subsequently published to the National Vulnerability Database.

Critical Impact
An attacker who convinces a user to open a malicious image file can execute arbitrary code with the privileges of the logged-in user, enabling malware installation, credential theft, or lateral movement.

Affected Products

Adobe Photoshop Desktop 24.7.4 and earlier (24.x branch)
Adobe Photoshop Desktop 25.11 and earlier (25.x branch)
Microsoft Windows and Apple macOS installations of the above versions

Discovery Timeline

2024-09-13 - CVE-2024-45109 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45109

Vulnerability Analysis

The flaw is an out-of-bounds write in Adobe Photoshop's file parsing logic. When Photoshop processes a specifically malformed image or project file, the application writes data past the boundary of an allocated memory buffer. This corruption of adjacent memory structures gives an attacker control over program state and can be leveraged to hijack execution flow.

Because the write occurs in the user-mode Photoshop process, resulting code runs with the current user's privileges. On workstations where designers and creative staff operate with local administrator rights, the impact expands to full host compromise. The vulnerability is classified under CWE-787: Out-of-bounds Write.

Root Cause

The root cause is missing or incorrect validation of size and offset fields when parsing untrusted file content. Photoshop supports numerous complex file formats such as PSD, TIFF, and PDF-derived containers, each requiring careful bounds checking during deserialization. A crafted structure causes the parser to compute an incorrect destination or length, resulting in a write past the allocated buffer.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a malicious file to the victim through email, chat, a compromised website, or a shared design asset. When the user opens the file in Adobe Photoshop, the parser triggers the out-of-bounds write and executes attacker-supplied code. No network-based exploitation is possible without user action.

No public proof-of-concept exploit is currently associated with this CVE, and it is not listed on the CISA Known Exploited Vulnerabilities catalog. See the Adobe Photoshop Security Advisory APSB24-72 for vendor technical detail.

Detection Methods for CVE-2024-45109

Indicators of Compromise

Unexpected child processes such as cmd.exe, powershell.exe, or bash spawned from Photoshop.exe or Adobe Photoshop 2024.
Crashes or abnormal termination of Photoshop.exe shortly after opening a file received from an external source.
Newly created executables, scripts, or scheduled tasks in the user profile immediately after a Photoshop session.
Outbound network connections initiated by the Photoshop process to previously unseen domains or IP addresses.

Detection Strategies

Hunt for process ancestry where Photoshop is the parent of a shell, script interpreter, or rundll32.exe.
Monitor image and document files with unusual sizes or embedded objects opened from download or mail directories.
Alert on writes to autorun locations such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run sourced from Photoshop.
Correlate application crash telemetry (Windows Error Reporting, macOS crash reports) referencing Photoshop with subsequent suspicious activity.

Monitoring Recommendations

Ingest EDR process, file, and network telemetry into a centralized data lake and retain at least 90 days for retrospective hunts.
Track Photoshop version inventory across managed endpoints to identify hosts still running vulnerable builds.
Enable exploit protection logging on Windows (Data Execution Prevention, Control Flow Guard) and review blocked events from Photoshop.

How to Mitigate CVE-2024-45109

Immediate Actions Required

Upgrade Adobe Photoshop to the fixed builds released in Adobe Security Bulletin APSB24-72: Photoshop 24.7.5 or Photoshop 25.12 and later.
Inventory all endpoints running Photoshop and prioritize creative and design workstations for immediate patching.
Instruct users not to open Photoshop files received from untrusted email, messaging, or web sources until patching completes.
Ensure Photoshop users operate with standard, non-administrator accounts to limit blast radius of exploitation.

Patch Information

Adobe released fixed versions concurrent with the September 2024 security bulletin. Administrators should deploy the updates through Adobe Creative Cloud Desktop, enterprise deployment tools such as Adobe Admin Console, or standard software distribution platforms. Refer to the Adobe Photoshop Security Advisory APSB24-72 for exact fixed version strings and download instructions.

Workarounds

Block inbound delivery of Photoshop-native file types (.psd, .psb, .pdd) from external senders at the mail gateway until patching is complete.
Restrict Photoshop file associations so that double-clicking an untrusted file does not auto-launch Photoshop.
Apply application allow-listing to prevent Photoshop from spawning shells, script interpreters, or unsigned binaries.

bash

# Example: query installed Photoshop version on Windows to identify vulnerable hosts
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Photoshop*" } |
  Select-Object DisplayName, DisplayVersion, InstallLocation