CVE-2025-30326: Adobe Photoshop RCE Vulnerability

CVE-2025-30326 Overview

Adobe Photoshop Desktop contains an Access of Uninitialized Pointer vulnerability [CWE-824] that enables arbitrary code execution in the context of the current user. The flaw affects Photoshop Desktop versions 26.5, 25.12.2, and earlier releases. Exploitation requires the victim to open a malicious file crafted by an attacker. Adobe addressed the issue in security bulletin APSB25-40.

Critical Impact
Successful exploitation yields arbitrary code execution with the privileges of the logged-in user, allowing attackers to install programs, modify data, or create new accounts.

Affected Products

Adobe Photoshop Desktop 26.5 and earlier
Adobe Photoshop Desktop 25.12.2 and earlier
Both Windows and macOS installations

Discovery Timeline

2025-05-13 - CVE-2025-30326 published to NVD
2025-05-15 - Last updated in NVD database

Technical Details for CVE-2025-30326

Vulnerability Analysis

The vulnerability is classified as Access of Uninitialized Pointer [CWE-824]. Photoshop dereferences a pointer that has not been assigned a valid memory address before use. When the application parses a malicious file, the uninitialized pointer can reference attacker-controlled memory regions. This condition can be turned into arbitrary code execution under the current user's privileges.

The attack vector is local and requires user interaction. A victim must open a crafted file in a vulnerable Photoshop build for exploitation to succeed. The scope is unchanged, but confidentiality, integrity, and availability impacts are all high because code runs with the user's session privileges.

Root Cause

The root cause lies in Photoshop's file parsing logic, where a pointer used during object handling is referenced before being initialized to a known-valid value. When the parser encounters specifically malformed structures in a supported file format, the uninitialized pointer value is dereferenced. Attackers who can influence the memory layout at the time of dereference can redirect execution flow.

Attack Vector

Exploitation follows a client-side, file-based pattern. An attacker delivers a malicious file through email attachments, web downloads, or shared storage. When the victim opens the file in a vulnerable Photoshop version, the parser triggers the uninitialized pointer access. Adobe has not reported in-the-wild exploitation, and no public proof-of-concept is currently available. See the Adobe Photoshop Security Advisory APSB25-40 for vendor-supplied technical context.

Detection Methods for CVE-2025-30326

Indicators of Compromise

Unexpected child processes spawned by Photoshop.exe or Adobe Photoshop on macOS, particularly shells, scripting engines, or rundll32.exe.
Photoshop process crashes or unhandled exception events recorded shortly after opening a file received from an external source.
Files with Photoshop-associated extensions (.psd, .psb, .iff, .tiff) delivered through phishing email or untrusted download sources.

Detection Strategies

Monitor endpoint telemetry for anomalous process trees originating from Photoshop, including outbound network connections initiated by the application.
Inspect Windows Event Logs and macOS unified logs for application crash signatures referencing Photoshop modules immediately after file-open events.
Apply behavioral identification rules that flag image-editing applications loading scripting interpreters or writing executables to disk.

Monitoring Recommendations

Track installed Photoshop versions across managed endpoints and alert on builds at or below 26.5 and 25.12.2.
Correlate file delivery events (email gateway, web proxy) with subsequent Photoshop file-open activity to identify suspicious attachments.
Enable crash dump collection on workstations running creative software so analysts can review memory state after suspected exploitation attempts.

How to Mitigate CVE-2025-30326

Immediate Actions Required

Update Adobe Photoshop to the fixed releases listed in Adobe Security Bulletin APSB25-40.
Inventory endpoints with creative software installed and prioritize patching for users who routinely open externally sourced files.
Reinforce user guidance to avoid opening Photoshop files from untrusted sources, including unsolicited email attachments.

Patch Information

Adobe released fixed versions of Photoshop Desktop addressing CVE-2025-30326 on 2025-05-13. Administrators should deploy the updated builds through the Adobe Creative Cloud desktop application or enterprise deployment tooling. Refer to APSB25-40 for the exact fixed version numbers for both the 26.x and 25.x branches.

Workarounds

Restrict opening Photoshop files originating from external or unverified sources until patches are deployed.
Run Photoshop under standard user accounts rather than administrative accounts to limit the impact of successful exploitation.
Use email and web gateway controls to inspect or quarantine Photoshop file types delivered from outside the organization.

bash

# Example: query installed Photoshop version on Windows endpoints via PowerShell
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate