CVE-2026-75862: Adobe Photoshop Integer Overflow RCE Flaw

CVE-2026-75862 Overview

Adobe Photoshop Desktop contains an integer overflow or wraparound vulnerability [CWE-190] that can lead to arbitrary code execution in the context of the current user. An attacker crafts a malicious file and delivers it to a target. When the victim opens the file in Photoshop, the flawed arithmetic operation wraps a size or index value, corrupting subsequent memory operations. Exploitation requires user interaction and local file handling.

Critical Impact

Successful exploitation allows arbitrary code execution with the privileges of the logged-in user, enabling malware installation, credential theft, or lateral movement from a workstation.

Affected Products

• Adobe Photoshop Desktop (see Adobe Photoshop Security Update APSB26-130 for affected versions)
• Windows installations of Photoshop Desktop
• macOS installations of Photoshop Desktop

Discovery Timeline

• 2026-09-08 - CVE-2026-75862 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75862

Vulnerability Analysis

The vulnerability originates in Photoshop's file parsing logic, where arithmetic on untrusted values from a crafted file exceeds the storage width of an integer variable. The wrapped result is then used to size a buffer, calculate an offset, or bound a loop. Downstream memory operations write past intended boundaries or read from attacker-controlled addresses, producing conditions that enable arbitrary code execution.

Because Photoshop runs in the user session, code executed through this flaw inherits full user privileges. Attackers commonly use this foothold to drop persistence, harvest browser credentials, or stage additional payloads.

Root Cause

The root cause is missing or insufficient validation of size-related fields parsed from image or project files [CWE-190]. Arithmetic performed on these fields produces a value smaller than expected, defeating length checks and allowing corruption of adjacent memory structures.

Attack Vector

The attack requires local file access and user interaction. An attacker delivers a crafted file via email, download, shared storage, or a supply chain compromise. When the victim opens the file, Photoshop parses the malicious structure and triggers the overflow. Network exploitation is not possible without user action to open the file.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. For technical details, refer to the Adobe Photoshop Security Update APSB26-130.

Detection Methods for CVE-2026-75862

Indicators of Compromise

• Photoshop process (Photoshop.exe on Windows, Adobe Photoshop on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters.
• Unexpected outbound network connections initiated by the Photoshop process shortly after opening a file.
• Photoshop process crashes with access violation exceptions correlated with opening third-party files.
• Creation of executable files or scheduled tasks in user-writable directories following a Photoshop session.

Detection Strategies

• Hunt for anomalous parent-child process relationships where Photoshop launches interpreters or LOLBins.
• Monitor for Photoshop making unexpected file writes to AppData, Startup, or LaunchAgents directories.
• Alert on Photoshop crash telemetry (WER or CrashReporter) that coincides with file open operations from untrusted sources.

Monitoring Recommendations

• Ingest endpoint process, file, and network telemetry into a centralized analytics platform to correlate Photoshop activity with post-exploitation behavior.
• Track file provenance to identify Photoshop files originating from email attachments, browser downloads, or removable media.
• Baseline normal Photoshop network behavior and alert on deviations such as connections to unfamiliar domains or IPs.

How to Mitigate CVE-2026-75862

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-130 to all Photoshop Desktop installations.
• Inventory workstations running Photoshop and prioritize patching for users who routinely handle files from external parties.
• Instruct users to avoid opening Photoshop files received from untrusted or unverified sources until patching is complete.

Patch Information

Adobe has released a security update addressing CVE-2026-75862. Consult the Adobe Photoshop Security Update APSB26-130 advisory for fixed version numbers and update procedures for both Windows and macOS.

Workarounds

• Restrict opening of Photoshop files to those originating from trusted internal sources.
• Use application allowlisting and attack surface reduction rules to prevent Photoshop from spawning script interpreters and command shells.
• Run Photoshop under standard user accounts, not administrative accounts, to limit the blast radius of successful exploitation.

# Verify installed Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app/Contents/Info.plist" CFBundleShortVersionString

# Verify installed Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Photoshop*" } |
  Select-Object DisplayName, DisplayVersion