CVE-2025-30325: Adobe Photoshop RCE Vulnerability

CVE-2025-30325 Overview

CVE-2025-30325 is an integer overflow vulnerability affecting Adobe Photoshop Desktop versions 26.5, 25.12.2, and earlier. The flaw enables arbitrary code execution in the context of the current user when a victim opens a malicious file. The vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and impacts Photoshop installations on both Windows and macOS platforms.

Exploitation requires user interaction, as the attacker must convince the target to open a crafted file. No public proof-of-concept exploit exists, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Successful exploitation grants attackers arbitrary code execution with the privileges of the logged-on Photoshop user, enabling malware deployment and data theft.

Affected Products

Adobe Photoshop Desktop 26.5 and earlier
Adobe Photoshop Desktop 25.12.2 and earlier
Microsoft Windows and Apple macOS installations of Photoshop

Discovery Timeline

2025-05-13 - CVE-2025-30325 published to NVD
2025-05-22 - Last updated in NVD database

Technical Details for CVE-2025-30325

Vulnerability Analysis

The vulnerability is an integer overflow or wraparound condition in Adobe Photoshop's file parsing logic. When Photoshop processes a malformed image or project file, an arithmetic operation produces a value that exceeds the maximum size of its integer type. The resulting wraparound yields an undersized allocation or incorrect bounds calculation.

Attackers leverage this miscalculation to corrupt adjacent memory during subsequent read or write operations. The corruption can be shaped to redirect execution flow, ultimately running attacker-supplied shellcode in the Photoshop process. The exploit executes with the privileges of the current user.

The attack vector is local and requires user interaction. A victim must open a malicious file delivered through email, web download, or shared storage. No elevated privileges are required for the attacker to weaponize the file.

Root Cause

The root cause is improper validation of size or length fields read from untrusted file content. Photoshop performs arithmetic on these values without checking for overflow before allocating buffers or indexing arrays. See the Adobe Photoshop Security Advisory for vendor-supplied technical context.

Attack Vector

The attacker crafts a malicious Photoshop-compatible file containing values designed to trigger the overflow. The file is delivered through phishing, malicious websites, or supply chain compromise. When opened, Photoshop parses the file, the overflow occurs, and arbitrary code executes in the user's security context.

// No verified proof-of-concept code is publicly available.
// Refer to the Adobe Photoshop Security Advisory (APSB25-40) for technical details.

Detection Methods for CVE-2025-30325

Indicators of Compromise

Unexpected child processes spawned by Photoshop.exe on Windows or Adobe Photoshop on macOS, particularly command interpreters such as cmd.exe, powershell.exe, or /bin/sh.
Photoshop process performing outbound network connections to unfamiliar hosts shortly after opening a file.
Photoshop project files (.psd, .psb) received from untrusted sources or with anomalous structure.

Detection Strategies

Monitor process lineage for Photoshop spawning shells, scripting engines, or LOLBins.
Inspect file integrity and origin metadata for image and design files arriving via email or downloads.
Correlate Photoshop crashes or unexpected exits with subsequent suspicious process activity on the same host.

Monitoring Recommendations

Enable endpoint logging for process creation events with full command-line capture across creative workstations.
Track installed Adobe Photoshop versions across the fleet and flag hosts running 26.5, 25.12.2, or earlier.
Alert on Photoshop writing executable content to user-writable directories such as %APPDATA% or ~/Library.

How to Mitigate CVE-2025-30325

Immediate Actions Required

Update Adobe Photoshop to the fixed versions identified in Adobe Security Bulletin APSB25-40 on all Windows and macOS endpoints.
Inventory creative and design workstations to identify any installations still running 26.5, 25.12.2, or earlier.
Instruct users to avoid opening Photoshop files received from untrusted or unverified sources until patching completes.

Patch Information

Adobe published fixes in the Adobe Photoshop Security Advisory APSB25-40. Administrators should deploy the updated Photoshop builds through Adobe Creative Cloud or enterprise software distribution tooling.

Workarounds

Restrict opening of Photoshop files to those originating from trusted internal sources until updates are applied.
Run Photoshop under standard user accounts to limit the blast radius of arbitrary code execution.
Apply application allowlisting to prevent Photoshop from launching child processes that are not part of normal workflows.

bash

# Verify the installed Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2025/Adobe Photoshop 2025.app/Contents/Info.plist" CFBundleShortVersionString

# Verify the installed Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Photoshop*" } |
  Select-Object DisplayName, DisplayVersion