CVE-2026-75631 Overview
Adobe Photoshop Desktop contains an out-of-bounds write vulnerability [CWE-787] that allows arbitrary code execution in the context of the current user. An attacker crafts a malicious file that triggers memory corruption when Photoshop parses it. Exploitation requires user interaction: the victim must open the malicious file in Photoshop.
The vulnerability affects the desktop version of Adobe Photoshop. Successful exploitation grants the attacker the same privileges as the logged-in user, enabling installation of malware, credential theft, or lateral movement from a compromised workstation.
Critical Impact
An attacker who convinces a user to open a crafted image file can execute arbitrary code with the current user's privileges, leading to full workstation compromise.
Affected Products
- Adobe Photoshop Desktop (see Adobe advisory APSB26-130 for affected versions)
Discovery Timeline
- 2026-09-08 - CVE-2026-75631 published to the National Vulnerability Database
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-75631
Vulnerability Analysis
The flaw is an out-of-bounds write in Adobe Photoshop Desktop's file parsing logic. When Photoshop processes a specially crafted file, it writes data past the boundary of an allocated buffer. This corrupts adjacent memory, which an attacker can shape to redirect execution flow.
The attack vector is local and requires user interaction. The victim must open the malicious file with Photoshop. Once execution begins, the attacker gains code execution at the privilege level of the current user. On workstations where the user holds administrative rights, the impact expands accordingly.
Adobe has not publicly disclosed the specific file format or parser component involved. The advisory rates confidentiality, integrity, and availability impacts as high, consistent with arbitrary code execution outcomes.
Root Cause
The root cause is improper bounds checking during parsing of untrusted file content. Photoshop reads attacker-controlled length or offset values from the file and uses them without validating against destination buffer size. Additional technical detail is documented in the Adobe Photoshop Security Advisory APSB26-130.
Attack Vector
An attacker delivers a crafted file through email, a file-sharing service, or a malicious website. When the victim opens the file in Photoshop, the vulnerable parser writes attacker-controlled data outside the intended buffer. This overwrites adjacent structures such as function pointers or object metadata, enabling control of execution.
No synthetic exploitation code is included. Refer to the vendor advisory for authoritative details.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-75631
Indicators of Compromise
- Unexpected Photoshop.exe child processes such as cmd.exe, powershell.exe, or rundll32.exe
- Photoshop process crashes or exception events immediately after opening a file from an untrusted source
- Outbound network connections initiated by Photoshop.exe to unfamiliar hosts
- Recently opened image files with anomalous headers, unusual sizes, or non-standard extensions
Detection Strategies
- Deploy behavioral endpoint detection that flags process lineage anomalies from creative applications spawning shells or script interpreters
- Correlate Photoshop crash telemetry with subsequent file-write or persistence activity on the same host
- Monitor for suspicious file drops in %APPDATA%, %TEMP%, and startup folders following Photoshop execution
Monitoring Recommendations
- Ingest endpoint process, file, and network telemetry into a centralized data lake for cross-source correlation
- Alert on execution of unsigned binaries or scripts spawned by Adobe applications
- Track email and web gateway logs for delivery of image files from external senders to users running Photoshop
How to Mitigate CVE-2026-75631
Immediate Actions Required
- Apply the Adobe security update referenced in advisory APSB26-130 to all Photoshop Desktop installations
- Inventory endpoints running Photoshop and prioritize patching workstations with administrative users
- Instruct users to avoid opening image files from untrusted or unverified sources until patches are deployed
Patch Information
Adobe has released a fixed version of Photoshop Desktop. Consult the Adobe Photoshop Security Advisory APSB26-130 for the patched build numbers and download links. Update through the Adobe Creative Cloud desktop application or enterprise deployment tooling.
Workarounds
- Restrict Photoshop use to standard user accounts to limit the blast radius of successful exploitation
- Block or quarantine image file attachments from untrusted external senders at the email gateway
- Apply application allowlisting to prevent Photoshop from spawning shell or scripting interpreter processes
# Verify installed Photoshop version on Windows
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s /v Version
# Verify installed Photoshop version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
