CVE-2026-104346: Photoshop Desktop RCE Vulnerability

CVE-2026-104346 Overview

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability [CWE-787] that allows arbitrary code execution in the context of the current user. Attackers exploit the flaw by crafting a malicious file and convincing a victim to open it in Photoshop. Successful exploitation grants the attacker the same privileges held by the user running the application.

The vulnerability is tracked under Adobe security bulletin APSB26-158. Adobe has published patched versions through its official security update channel.

Critical Impact

Opening a malicious file in Photoshop can trigger arbitrary code execution with the current user's privileges, enabling full compromise of user data and credentials on the host.

Affected Products

• Adobe Photoshop Desktop
• Refer to Adobe Photoshop Security Update APSB26-158 for specific affected versions
• Both Windows and macOS installations of Photoshop Desktop are typically in scope for Adobe advisories of this type

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-104346 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-104346

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition in Adobe Photoshop Desktop. Photoshop processes complex image, metadata, and project file formats. When parsing a malformed file, the application writes data past the boundary of an allocated memory buffer. This corruption of adjacent memory can be shaped by an attacker to overwrite control data such as function pointers or object vtables.

An attacker who controls the layout of the overwritten memory can redirect execution flow and run arbitrary code. The execution runs with the privileges of the user who opened the file. On workstations where users operate with administrative rights, this extends the blast radius to the full host.

Exploitation requires user interaction. The victim must open the attacker-supplied file within Photoshop. The attack vector is local, meaning the file must be delivered to and processed on the target system through channels such as email attachments, shared drives, or web downloads.

Root Cause

The root cause falls under [CWE-787] Out-of-Bounds Write. The application fails to validate that an index, offset, or length derived from untrusted file content stays within the bounds of a destination buffer. The resulting write corrupts memory outside the intended allocation.

Attack Vector

The attacker crafts a malicious Photoshop-compatible file containing malformed structures that trigger the out-of-bounds write during parsing. The file is delivered through phishing, file-sharing platforms, or malicious websites. When the victim opens the file in Photoshop, the parser corrupts memory and transfers control to attacker-supplied shellcode.

See the Adobe Photoshop Security Update APSB26-158 for technical details.

Detection Methods for CVE-2026-104346

Indicators of Compromise

• Photoshop processes (Photoshop.exe on Windows, Adobe Photoshop on macOS) spawning command interpreters such as cmd.exe, powershell.exe, bash, or osascript
• Unexpected network connections initiated by the Photoshop process to external hosts
• Creation of executable files, scripts, or scheduled tasks by the Photoshop process
• Photoshop crash events referencing access violations or heap corruption shortly after opening a file received from an external source

Detection Strategies

• Monitor for anomalous child-process creation from Photoshop binaries, which is highly unusual during normal use
• Alert on Photoshop writing to autorun locations, startup folders, or system directories
• Correlate email or download delivery of image and project files with subsequent process-execution anomalies on the opening host
• Hunt for Photoshop process memory regions marked as both writable and executable, consistent with shellcode staging

Monitoring Recommendations

• Enable endpoint telemetry for process creation, file writes, and network connections originating from Photoshop
• Collect application crash logs centrally and investigate repeated crashes tied to specific file hashes
• Baseline normal Photoshop network behavior and alert on deviations such as outbound connections to uncommon destinations

How to Mitigate CVE-2026-104346

Immediate Actions Required

• Apply the Adobe-provided updates referenced in APSB26-158 to all Photoshop Desktop installations
• Inventory endpoints running Photoshop and prioritize patching for users who handle externally sourced files
• Instruct users to avoid opening Photoshop files received from untrusted or unverified sources until patches are deployed
• Restrict local administrator rights so that successful exploitation does not yield elevated privileges

Patch Information

Adobe has released fixed versions through its security update process. Consult the Adobe Photoshop Security Update APSB26-158 for the specific patched version numbers, supported platforms, and download instructions. Use the Adobe Creative Cloud desktop application to deploy updates, or push managed updates through enterprise software distribution tooling.

Workarounds

• Block delivery of unsolicited Photoshop project files (.psd, .psb) and related image formats at email and web gateways where feasible
• Open suspect files only in isolated virtual machines or sandboxed environments disconnected from sensitive resources
• Apply application-control policies that prevent Photoshop from spawning scripting interpreters or writing to sensitive directories

# Verify installed Photoshop version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app"

# Verify installed Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion