CVE-2026-75771: Photoshop Desktop RCE Vulnerability

CVE-2026-75771 Overview

Adobe Photoshop Desktop contains an integer overflow or wraparound vulnerability [CWE-190] that allows arbitrary code execution in the context of the current user. An attacker crafts a malicious file that triggers the arithmetic flaw when Photoshop parses it. Successful exploitation grants the attacker the same privileges as the logged-in user, enabling code execution, file access, and persistence on the host.

Exploitation requires user interaction. The victim must open the malicious file locally within Photoshop for the vulnerable code path to execute. No network exposure or elevated privileges are needed to trigger the flaw.

Critical Impact
Arbitrary code execution in the current user's context through a crafted Photoshop file, enabling attacker-controlled code to run without privilege escalation.

Affected Products

Adobe Photoshop Desktop (see the Adobe Photoshop Security Advisory for affected versions)

Discovery Timeline

2026-09-08 - CVE-2026-75771 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75771

Vulnerability Analysis

The flaw is an integer overflow or wraparound [CWE-190] within Photoshop's file parsing logic. When Photoshop processes attacker-controlled values from a crafted file, an arithmetic operation exceeds the maximum value of the integer type and wraps to a small or negative value. Downstream code then uses that corrupted value to size buffers, index memory, or drive loop counters.

The corrupted size leads to memory corruption, typically an undersized allocation followed by an oversized copy. Attackers shape the file structure to control the corrupted data, redirecting execution into attacker-supplied shellcode or gadget chains. The result is arbitrary code execution within the Photoshop process.

Root Cause

The root cause is missing or insufficient validation of size-related fields before arithmetic operations. Photoshop trusts values read from the file container without checking whether multiplication, addition, or type conversion can overflow the target integer width. This condition matches the pattern documented in CWE-190: Integer Overflow or Wraparound.

Attack Vector

The attack vector is local and requires user interaction. An attacker delivers a crafted image or project file through email, a shared drive, a download, or a collaboration platform. The victim opens the file in Photoshop, at which point the vulnerable parser processes the malicious structures and triggers the overflow.

Since the code executes as the current user, the attacker inherits that user's file system access, network privileges, and cached credentials. On workstations where designers hold access to sensitive assets or source repositories, the impact extends beyond the local host. See the Adobe Photoshop Security Advisory for technical guidance.

Detection Methods for CVE-2026-75771

Indicators of Compromise

Photoshop process (Photoshop.exe on Windows, Adobe Photoshop on macOS) spawning command interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Unexpected child processes, DLL loads, or outbound network connections initiated by the Photoshop process shortly after a file open event.
Crashes or exception events in Photoshop correlated with opening files received from external sources.
Creation of executables, scripts, or scheduled tasks in user-writable paths following a Photoshop file open.

Detection Strategies

Monitor process ancestry for Photoshop spawning shells, script hosts, or LOLBins, which is not expected behavior for image editing workflows.
Correlate Photoshop file open telemetry with subsequent file writes, registry changes, or persistence artifacts within the same user session.
Alert on Photoshop process crashes followed by module loads from non-Adobe directories or from temporary paths.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry from workstations running Photoshop into a centralized analytics platform.
Track inventory of installed Photoshop versions to identify hosts still running unpatched builds identified in the Adobe advisory.
Review email and file-sharing gateways for inbound Photoshop file types (.psd, .psb, .pdd, and related formats) from untrusted senders.

How to Mitigate CVE-2026-75771

Immediate Actions Required

Apply the update referenced in the Adobe Photoshop Security Advisory to all endpoints running Photoshop Desktop.
Instruct users to avoid opening Photoshop files from untrusted or unverified sources until patches are deployed.
Prioritize patching for creative, marketing, and design workstations that regularly receive external files.

Patch Information

Adobe published fixes for this vulnerability in security bulletin APSB26-130. Refer to the Adobe Photoshop Security Advisory for the fixed version numbers and download links applicable to each supported release.

Workarounds

Restrict opening of Photoshop files to those originating from trusted internal repositories until patches are applied.
Run Photoshop under standard user accounts, never with administrative privileges, to limit the blast radius of exploitation.
Enforce application allowlisting to prevent Photoshop from spawning unauthorized child processes such as shells and script interpreters.

bash

# Example: verify installed Photoshop version on Windows
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s | findstr /i "Version"

# Example: verify installed Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app/Contents/Info.plist" CFBundleShortVersionString