CVE-2026-76199: Adobe Photoshop Desktop RCE Vulnerability

CVE-2026-76199 Overview

Adobe Photoshop Desktop contains an Uncontrolled Search Path Element vulnerability [CWE-427] that allows arbitrary code execution in the context of the current user. An attacker can exploit this flaw by convincing a victim to open a malicious file, which causes Photoshop to load an attacker-controlled library from an untrusted search path. Successful exploitation results in a scope change, meaning code executed through Photoshop can affect resources beyond the application itself.

Critical Impact

Arbitrary code execution in the user's context with high impact to confidentiality, integrity, and availability. User interaction is required, but no privileges are needed to launch the attack.

Affected Products

• Adobe Photoshop Desktop (see Adobe Photoshop Security Update APSB26-130 for affected versions)
• Windows and macOS installations of Photoshop Desktop
• Environments where users open Photoshop project files from untrusted sources

Discovery Timeline

• 2026-09-08 - CVE-2026-76199 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-76199

Vulnerability Analysis

The vulnerability is an Uncontrolled Search Path Element weakness [CWE-427] in Photoshop Desktop. When Photoshop loads dependent libraries or plug-ins, it resolves them through a search path that includes locations an attacker can influence. An attacker who places a malicious dynamic library in a directory Photoshop searches before trusted locations can hijack the loading process. When the victim opens a crafted file, Photoshop loads and executes the attacker's code in the user's session.

The CVSS vector indicates a local attack vector with required user interaction and a scope change. The scope change is significant because code loaded through Photoshop can access resources managed under a different security authority than the application itself.

Root Cause

The root cause is improper control over how Photoshop resolves paths to external components. The application does not enforce fully qualified paths or restrict its library search order to trusted directories. This allows dynamic library search order hijacking, commonly referred to as DLL search order hijacking on Windows or dylib hijacking on macOS.

Attack Vector

Exploitation requires a victim to open a malicious file, typically distributed through phishing, file-sharing sites, or supply chain compromise. The attacker stages a malicious library in a directory Photoshop searches, then delivers a project file that triggers loading of the corresponding component. Because execution occurs under the current user, the attacker inherits that user's file access, network privileges, and any cached credentials available to the session.

No verified proof-of-concept code is publicly available. Refer to the Adobe Photoshop Security Update APSB26-130 for vendor-provided technical details.

Detection Methods for CVE-2026-76199

Indicators of Compromise

• Photoshop process (Photoshop.exe on Windows, Adobe Photoshop on macOS) loading unsigned or unexpected dynamic libraries from user-writable directories such as Downloads, Temp, or the working directory of an opened file.
• Creation of DLL or dylib files in directories adjacent to Photoshop project files (.psd, .psb) received from external sources.
• Photoshop spawning unexpected child processes such as cmd.exe, powershell.exe, or shell interpreters shortly after opening a file.

Detection Strategies

• Monitor image load events for the Photoshop process and alert on libraries loaded from paths outside standard Adobe installation directories.
• Correlate file open events for Photoshop project files with subsequent library loads from the same or adjacent directories.
• Hunt for anomalous parent-child process relationships where Photoshop launches scripting engines, network utilities, or credential access tools.

Monitoring Recommendations

• Enable command-line and module load auditing on endpoints running Photoshop and forward events to a centralized logging platform for retention and correlation.
• Track outbound network connections initiated by the Photoshop process and flag connections to newly observed or low-reputation destinations.
• Baseline the set of legitimate plug-ins and libraries loaded by Photoshop, then alert on deviations from that baseline.

How to Mitigate CVE-2026-76199

Immediate Actions Required

• Apply the Adobe security update referenced in APSB26-130 to all Photoshop Desktop installations.
• Instruct users not to open Photoshop project files received from untrusted sources or extracted from archives placed in shared or temporary directories.
• Inventory endpoints running Photoshop and prioritize patching for systems used by high-value users such as designers with access to sensitive intellectual property.

Patch Information

Adobe published a security update for Photoshop Desktop documented in advisory APSB26-130. Administrators should review the Adobe Photoshop Security Update advisory to identify affected versions and deploy the fixed release through the Adobe Creative Cloud desktop application or enterprise deployment tooling.

Workarounds

• Restrict write permissions on directories in the Photoshop library search path so standard users cannot drop dynamic libraries into locations the application will load.
• Enforce application allowlisting to prevent Photoshop from loading unsigned dynamic libraries from user-writable paths.
• Open untrusted Photoshop files only inside isolated environments such as dedicated virtual machines with no access to production credentials or data.

# Example: audit non-standard DLL loads by Photoshop on Windows using Sysmon Event ID 7
# Filter for ImageLoaded events where Image is Photoshop.exe and ImageLoaded path
# is outside the Adobe installation directory
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=7} |
  Where-Object {
    $_.Message -match 'Photoshop\.exe' -and
    $_.Message -notmatch 'C:\\Program Files\\Adobe'
  }