CVE-2024-49514: Adobe Photoshop RCE Vulnerability

CVE-2024-49514 Overview

CVE-2024-49514 is an integer underflow vulnerability affecting Adobe Photoshop Desktop versions 24.7.3, 25.11, and earlier. The flaw resides in the application's file parsing logic and can result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file crafted by an attacker. The vulnerability is categorized under [CWE-191] Integer Underflow (Wrap or Wraparound). Adobe published a security advisory addressing this issue as part of bulletin APSB24-89. Both Windows and macOS installations of Photoshop are affected.

Critical Impact
Successful exploitation grants attackers the ability to execute arbitrary code with the privileges of the logged-in Photoshop user, enabling further system compromise.

Affected Products

Adobe Photoshop Desktop version 24.7.3 and earlier
Adobe Photoshop Desktop version 25.11 and earlier
Installations on Microsoft Windows and Apple macOS

Discovery Timeline

2024-11-12 - CVE-2024-49514 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49514

Vulnerability Analysis

The vulnerability is an integer underflow condition classified under [CWE-191]. Integer underflow occurs when an arithmetic operation produces a value below the minimum representable value for the integer type, causing it to wrap around to a large positive number. In Photoshop, this behavior corrupts size or offset calculations used during file parsing. Downstream operations then reference memory using the corrupted value, enabling out-of-bounds reads, writes, or heap corruption. Attackers leverage this corruption to redirect execution flow and run arbitrary code.

Root Cause

The root cause is unchecked arithmetic on integer values derived from attacker-controlled fields in a crafted Photoshop input file. When the value used in a subtraction operation is smaller than the subtrahend, the result wraps around. Photoshop then treats the wrapped value as a legitimate size or index, leading to memory corruption during subsequent parsing.

Attack Vector

The attack vector is local and requires user interaction. An attacker must deliver a malicious file to the victim through channels such as email, web download, or shared storage. The victim must then open the file in a vulnerable version of Photoshop. Code executes with the privileges of the current user, so exploitation on a workstation used by an administrator grants broad system access. No network exposure is required, and no authentication is needed on the target system beyond the user session.

No public proof-of-concept code has been released. See the Adobe Photoshop Security Advisory for vendor technical details.

Detection Methods for CVE-2024-49514

Indicators of Compromise

Unexpected child processes spawned by Photoshop.exe or the macOS Photoshop binary, especially command shells, scripting hosts, or rundll32.exe.
Photoshop process crashes or exception events immediately after opening files received from external sources.
Photoshop writing executable files or scripts to user-writable directories such as %APPDATA% or ~/Library.

Detection Strategies

Inventory Photoshop installations across endpoints and flag any host running versions 24.7.3, 25.11, or earlier.
Monitor process lineage where Photoshop is the parent process and alert on non-standard child executables.
Correlate file-open telemetry with subsequent network connections initiated by the Photoshop process.

Monitoring Recommendations

Enable endpoint telemetry that records file writes, process creation, and module loads from Adobe applications.
Review email and web gateways for .psd, .psb, and related Photoshop file types delivered from untrusted senders.
Track user reports of Photoshop crashes and pair them with EDR crash telemetry for triage.

How to Mitigate CVE-2024-49514

Immediate Actions Required

Update Adobe Photoshop to the fixed versions listed in Adobe bulletin APSB24-89 on every affected Windows and macOS endpoint.
Restrict local administrator rights on workstations where Photoshop is used to limit the impact of code execution.
Instruct users not to open Photoshop files received from untrusted or unexpected sources.

Patch Information

Adobe released fixed versions of Photoshop Desktop addressing CVE-2024-49514. Consult the Adobe Photoshop Security Advisory for exact fixed build numbers and download instructions. Deploy the patch through Adobe Creative Cloud or enterprise software distribution tooling.

Workarounds

Block untrusted Photoshop file types at the email gateway until patching is complete.
Apply application allowlisting policies that prevent child processes from launching under Photoshop.exe.
Isolate high-risk users who routinely open external design files onto dedicated, patched workstations.

bash

# Verify installed Photoshop version on Windows via PowerShell
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion