CVE-2026-105896: Photoshop Desktop NULL Pointer DOS Attack

CVE-2026-105896 Overview

CVE-2026-105896 is a NULL Pointer Dereference vulnerability [CWE-476] in Adobe Photoshop Desktop. An attacker can exploit the flaw to crash the application, producing a denial-of-service condition on the local system. Exploitation requires user interaction. A victim must open a malicious file crafted by the attacker.

Adobe published a security advisory tracking this issue under bulletin APSB26-158. The vulnerability does not expose confidentiality or integrity, but it fully impacts availability of the Photoshop process. No public proof-of-concept exploit code or in-the-wild exploitation has been reported.

Critical Impact
A specially crafted file opened in Photoshop Desktop triggers a NULL pointer dereference that terminates the application, resulting in loss of unsaved work and local denial-of-service.

Affected Products

Adobe Photoshop Desktop (per Adobe advisory APSB26-158)
Specific version ranges: refer to the Adobe Photoshop Security Advisory
Platforms: Windows and macOS desktop installations

Discovery Timeline

2026-10-13 - CVE-2026-105896 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-105896

Vulnerability Analysis

The vulnerability is a NULL pointer dereference in Adobe Photoshop Desktop's file parsing logic. When Photoshop processes a malformed input file, a code path dereferences a pointer that was never initialized or that returned NULL from an upstream allocation or lookup. The resulting access violation terminates the process.

The attack is local and requires user interaction. The user must open the malicious file in Photoshop for the crash to occur. The impact is limited to application availability. The flaw does not grant code execution, memory disclosure, or privilege changes within the host operating system.

Adobe has not published exploitation details beyond its advisory. The low EPSS probability reflects the absence of weaponized exploit code and the user-interaction requirement.

Root Cause

The root cause is missing validation of a pointer value prior to dereference during file parsing. Photoshop supports a wide range of image container formats and embedded structures. A malformed structure field causes an internal lookup or allocation to yield NULL, which subsequent code uses without a check, triggering an access violation [CWE-476].

Attack Vector

An attacker crafts a malicious Photoshop-compatible file and delivers it to a victim through phishing email, a malicious website, file-sharing services, or a compromised asset repository. When the victim opens the file in Photoshop Desktop, the parser executes the vulnerable code path and the application crashes. No network access, elevated privileges, or interactive multi-step attack is required beyond opening the file.

No verified public exploit code is available. See the Adobe Photoshop Security Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-105896

Indicators of Compromise

Unexpected Photoshop.exe or Adobe Photoshop process termination events shortly after a user opens a file from an untrusted source.
Windows Application Event Log entries with event ID 1000 or 1001 referencing Photoshop as the faulting application with an access violation (0xC0000005).
macOS crash reports under ~/Library/Logs/DiagnosticReports/ naming Photoshop with a EXC_BAD_ACCESS signal.

Detection Strategies

Monitor endpoint telemetry for repeated Photoshop crashes correlated with file-open operations from email attachments, browser downloads, or removable media.
Hunt for inbound email or web traffic delivering Photoshop-compatible file formats (.psd, .psb, and related container types) from untrusted senders.
Correlate crash events with the source path of the opened file to identify suspicious delivery vectors.

Monitoring Recommendations

Enable centralized collection of Windows Application and macOS diagnostic logs to detect Photoshop faulting events at scale.
Alert when the same user experiences multiple Photoshop crashes within a short window, which may indicate active targeting.
Track Photoshop version inventory across endpoints to confirm patch coverage after Adobe releases the fix.

How to Mitigate CVE-2026-105896

Immediate Actions Required

Apply the Adobe Photoshop update referenced in bulletin APSB26-158 as soon as it is available in your deployment channel.
Instruct users to avoid opening Photoshop files received from untrusted or unverified sources until patches are deployed.
Inventory all endpoints with Adobe Photoshop Desktop installed and prioritize patching for users who routinely process external artwork.

Patch Information

Adobe addresses this vulnerability in the updates listed in the Adobe Photoshop Security Advisory APSB26-158. Administrators should deploy the vendor-provided update through Adobe Creative Cloud, enterprise deployment packages, or managed update tooling.

Workarounds

Restrict Photoshop file opens to files originating from trusted internal sources until the patch is applied.
Use email gateways and web proxies to inspect or quarantine Photoshop-compatible attachments from external senders.
Open suspicious design files inside an isolated virtual machine or sandbox where a crash does not affect production workstations.

bash

# Verify installed Adobe Photoshop version on Windows endpoints
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s /v Version

# Verify installed Adobe Photoshop version on macOS endpoints
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app"