CVE-2025-27198: Adobe Photoshop Buffer Overflow Vulnerability

CVE-2025-27198 Overview

CVE-2025-27198 is a heap-based buffer overflow vulnerability affecting Adobe Photoshop Desktop versions 25.12.1, 26.4.1, and earlier. Successful exploitation allows arbitrary code execution in the context of the current user. The flaw requires user interaction, meaning a victim must open a malicious file crafted by the attacker. The vulnerability impacts Photoshop installations on both Microsoft Windows and Apple macOS platforms. Adobe published the security advisory APSB25-30 to address the issue. The vulnerability maps to two related CWE classifications: heap-based buffer overflow [CWE-122] and out-of-bounds write [CWE-787].

Critical Impact
An attacker who tricks a user into opening a malicious Photoshop file can execute arbitrary code with that user's privileges, leading to full compromise of the affected workstation.

Affected Products

Adobe Photoshop Desktop 25.12.1 and earlier
Adobe Photoshop Desktop 26.4.1 and earlier
Apple macOS and Microsoft Windows installations of the above

Discovery Timeline

2025-04-08 - CVE-2025-27198 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2025-27198

Vulnerability Analysis

The vulnerability is a heap-based buffer overflow within Adobe Photoshop's file parsing logic. When Photoshop processes a specially crafted image or project file, the application writes data beyond the bounds of an allocated heap buffer. This out-of-bounds write corrupts adjacent heap metadata and program objects. An attacker who controls the overflow contents can hijack control flow and execute arbitrary code in the context of the user running Photoshop. Because Photoshop frequently runs under standard user accounts on creative workstations, exploitation yields direct access to user documents, credentials cached in the user profile, and network resources reachable from that session.

Root Cause

The root cause is improper validation of input data sizes during file parsing, classified jointly as [CWE-122] heap-based buffer overflow and [CWE-787] out-of-bounds write. The parser allocates a heap buffer based on one field while copying data based on another, producing a length mismatch. Adobe's advisory APSB25-30 confirms the defect and provides fixed builds.

Attack Vector

Exploitation is local and requires user interaction. The attacker delivers a malicious Photoshop-compatible file through email, a shared drive, a chat platform, or a watering-hole download. When the victim opens the file in a vulnerable Photoshop build, the parser triggers the overflow and executes attacker-supplied code. No elevated privileges are required to launch the attack, and the resulting code runs with the privileges of the logged-on user. No public proof-of-concept exploit is currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified public exploit code is available. See the Adobe Photoshop Security Advisory APSB25-30 for vendor technical details.

Detection Methods for CVE-2025-27198

Indicators of Compromise

Unexpected child processes spawned by Photoshop.exe or Adobe Photoshop on macOS, such as cmd.exe, powershell.exe, bash, or osascript.
Photoshop process crashes or unhandled exceptions logged shortly after a user opens a file from email, chat, or an untrusted share.
Outbound network connections originating from the Photoshop process to non-Adobe destinations.
Creation of executables, scripts, or scheduled tasks in user-writable directories immediately after a Photoshop file is opened.

Detection Strategies

Hunt for anomalous process trees where Photoshop is the parent of a shell, scripting interpreter, or LOLBin.
Correlate Photoshop application crash events with subsequent file-write or persistence activity in the same user session.
Inspect inbound email and collaboration platforms for Photoshop file types (.psd, .psb, .pdd) originating from external senders.
Use behavioral AI endpoint detection to flag in-memory code execution patterns following document-handler activity.

Monitoring Recommendations

Inventory all hosts running Adobe Photoshop and tag versions at or below 25.12.1 and 26.4.1 for prioritized patching.
Forward endpoint process, file, and network telemetry to a centralized data lake for retroactive hunting once new IoCs emerge.
Enable application crash reporting on creative workstations and route alerts to the SOC.
Monitor Adobe's security bulletin RSS feed for updates to APSB25-30 and related advisories.

How to Mitigate CVE-2025-27198

Immediate Actions Required

Upgrade Adobe Photoshop to the fixed versions identified in advisory APSB25-30 on all Windows and macOS endpoints.
Instruct users to avoid opening Photoshop files received from untrusted or unverified sources until patches are deployed.
Validate that endpoint protection is active on all creative workstations and that behavioral detection is enabled.
Audit software inventory to confirm no unmanaged or shadow-IT Photoshop installations remain on vulnerable builds.

Patch Information

Adobe released fixed Photoshop builds as part of security bulletin APSB25-30. Administrators should consult the Adobe Photoshop Security Advisory for the exact patched version numbers and download links, then deploy through Creative Cloud Desktop or enterprise deployment tooling such as the Adobe Admin Console.

Workarounds

Restrict Photoshop file types at the email gateway and collaboration platforms until patching completes.
Use application allowlisting to block Photoshop from spawning interactive shells or scripting interpreters.
Run Photoshop under standard user accounts only, never with administrative privileges, to limit blast radius.
Apply OS-level exploit mitigations (DEP, ASLR, CFG on Windows; Hardened Runtime on macOS) and verify they are enforced for the Photoshop process.

bash

# Windows: query installed Photoshop versions across managed endpoints
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Photoshop*" } | Select-Object Name, Version

# macOS: query installed Photoshop version
/usr/bin/mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2025/Adobe Photoshop 2025.app"