CVE-2026-100111: Photoshop Desktop RCE Vulnerability

CVE-2026-100111 Overview

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability [CWE-787] that enables arbitrary code execution in the context of the current user. An attacker crafts a malicious file and delivers it to a victim through phishing, file sharing, or web download. When the victim opens the file in Photoshop, the parser writes data outside the bounds of an allocated buffer. This corruption allows the attacker to control execution flow and run arbitrary code with the privileges of the logged-in user.

Critical Impact

Successful exploitation yields arbitrary code execution with the current user's privileges, enabling malware installation, credential theft, and lateral movement from a single opened file.

Affected Products

• Adobe Photoshop Desktop (see Adobe security bulletin APSB26-158 for affected versions)
• Windows and macOS installations of Photoshop Desktop
• Any workstation where users open untrusted image or project files in Photoshop

Discovery Timeline

• 2026-10-13 - CVE-2026-100111 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-100111

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe Photoshop Desktop's file parsing logic. Photoshop processes a wide range of image and project file formats, each with complex headers, chunks, and embedded metadata. When Photoshop parses a crafted file, it writes attacker-controlled data past the end of an allocated memory region. The attack requires local access and user interaction: a victim must open the malicious file. No prior authentication is required. The confidentiality, integrity, and availability of the affected host are all at risk once execution flow is hijacked.

Root Cause

The root cause is improper validation of size or offset values parsed from an untrusted file [CWE-787]. The parser trusts length fields or index values embedded in the file and uses them in write operations without verifying that the destination remains within the bounds of the allocated buffer. Attackers manipulate these fields to redirect writes to adjacent memory, corrupting heap metadata, function pointers, or object virtual tables. Adobe's advisory APSB26-158 documents the affected code path.

Attack Vector

The attack vector is local with required user interaction. An attacker constructs a malicious Photoshop-compatible file, often a PSD, TIFF, or related format, embedding crafted structures that trigger the out-of-bounds write. Delivery methods include spearphishing attachments, watering-hole downloads, and shared cloud storage links. When the victim opens the file in Photoshop, the parser processes the crafted structures and the write primitive executes. Attackers chain the memory corruption with heap grooming to achieve reliable arbitrary code execution. See the Adobe Photoshop Security Update APSB26-158 for vendor technical details.

Detection Methods for CVE-2026-100111

Indicators of Compromise

• Unexpected child processes spawned by Photoshop.exe or Adobe Photoshop.app, such as command shells, PowerShell, or scripting engines
• Photoshop processes making outbound network connections to unfamiliar hosts shortly after opening a file
• Crash dumps or Windows Error Reporting entries referencing access violations in Photoshop image parsing modules
• Suspicious image or project files received via email, chat, or cloud share from untrusted senders

Detection Strategies

• Monitor process lineage for Photoshop spawning interpreters, LOLBins, or persistence utilities
• Alert on Photoshop writing executable content to user-writable directories such as %APPDATA%, %TEMP%, or ~/Library
• Correlate Photoshop crashes with subsequent anomalous process creation on the same host

Monitoring Recommendations

• Ingest endpoint process, file, and network telemetry into a central analytics platform and retain for at least 90 days
• Baseline normal Photoshop network behavior and flag deviations such as HTTP POSTs to new domains
• Track email and web gateway logs for inbound PSD, TIFF, and related file formats from external senders

How to Mitigate CVE-2026-100111

Immediate Actions Required

• Apply the Adobe Photoshop update referenced in security bulletin APSB26-158 to all workstations running Photoshop Desktop
• Instruct users not to open Photoshop files received from untrusted sources until patching is complete
• Inventory endpoints running Photoshop and prioritize patching for designers, marketing staff, and other heavy users
• Validate that endpoint protection is active and up to date on all hosts running Photoshop

Patch Information

Adobe published a security update addressing CVE-2026-100111. Administrators should consult the Adobe Photoshop Security Update APSB26-158 for the fixed version numbers and download locations. Deploy the patched build through Adobe Creative Cloud, Adobe Admin Console, or your software distribution system. Verify installation by checking the Photoshop About dialog against the version listed in the bulletin.

Workarounds

• Restrict Photoshop file associations so untrusted files open in a sandboxed viewer first
• Enforce application allowlisting to block unauthorized child processes from Photoshop
• Operate workstations under standard user accounts to limit the impact of code execution in user context
• Use mail and web filtering to quarantine inbound PSD, PSB, and related image formats from external senders pending review

# Verify installed Photoshop version against the fixed build in APSB26-158
# Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion

# macOS (Terminal)
defaults read "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app/Contents/Info.plist" CFBundleShortVersionString