CVE-2026-82005: Adobe Photoshop Desktop RCE Vulnerability

CVE-2026-82005 Overview

Adobe Photoshop Desktop contains an out-of-bounds write vulnerability [CWE-787] that can lead to arbitrary code execution in the context of the current user. An attacker crafts a malicious file and delivers it to a target user through email, file-sharing services, or a compromised web page. When the victim opens the file in Photoshop, memory corruption occurs during file parsing and enables code execution.

The issue requires user interaction and executes locally with the privileges of the user running Photoshop. Adobe published the advisory APSB26-130 addressing this vulnerability.

Critical Impact
Arbitrary code execution in the context of the current user through a malicious file, potentially enabling malware installation, credential theft, or lateral movement from the compromised workstation.

Affected Products

Adobe Photoshop Desktop (see APSB26-130 for affected versions)
Windows and macOS installations of Photoshop Desktop
Enterprise Creative Cloud deployments including Photoshop

Discovery Timeline

2026-09-08 - CVE-2026-82005 published to the National Vulnerability Database
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-82005

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in Photoshop Desktop's file parsing logic. Out-of-bounds writes occur when an application writes data past the end, or before the beginning, of an allocated buffer. In image editors like Photoshop, this class of issue typically surfaces in parsers that process complex file formats containing embedded metadata, layers, filters, or compressed streams.

Successful exploitation corrupts adjacent memory structures. Attackers who control the corrupted values can redirect execution flow and run arbitrary code inside the Photoshop process. The code runs with the same permissions as the logged-on user, providing access to that user's documents, credentials cached by other applications, and network resources.

Exploitation is not trivial. The attack vector is local and requires the victim to open a malicious file, which limits mass exploitation compared to network-facing bugs. However, targeted attacks against designers, media organizations, and enterprises that routinely receive external artwork remain realistic.

Root Cause

Out-of-bounds writes in image parsers commonly result from insufficient validation of length, offset, or dimension fields inside file headers or chunk structures. When the parser trusts an attacker-supplied size and allocates or indexes a buffer based on it, subsequent memory writes can spill outside the intended region. Refer to the Adobe Photoshop Security Advisory APSB26-130 for the specific technical details.

Attack Vector

The attack vector is local with required user interaction. An attacker delivers a specially crafted Photoshop-compatible file through phishing, watering-hole websites, cloud collaboration platforms, or third-party asset marketplaces. When the victim opens the file in a vulnerable version of Photoshop, the parser processes the malicious structure and triggers the out-of-bounds write, resulting in arbitrary code execution as the current user.

Detection Methods for CVE-2026-82005

Indicators of Compromise

Photoshop processes (Photoshop.exe on Windows, Adobe Photoshop on macOS) spawning command interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Unexpected child processes performing network connections, file writes to startup locations, or scheduled task creation shortly after a Photoshop file is opened.
Photoshop crashes with access violation or memory corruption exceptions recorded in Windows Event Log or macOS crash reports around the time a new external file was opened.

Detection Strategies

Hunt for anomalous process lineage where Photoshop is the parent of scripting engines, LOLBins, or reconnaissance utilities.
Correlate file-open events for .psd, .psb, and imported image formats against subsequent outbound network activity from the Photoshop process.
Deploy behavioral endpoint detection that flags in-process shellcode execution and injection originating from Adobe applications.

Monitoring Recommendations

Ingest endpoint process, file, and network telemetry into a centralized data lake to enable retroactive hunting once new indicators emerge.
Alert on Photoshop writing executables, DLLs, or scripts into user-writable persistence paths such as %APPDATA%, ~/Library/LaunchAgents, or the Startup folder.
Monitor for Photoshop making outbound connections to non-Adobe domains, particularly newly registered or low-reputation infrastructure.

How to Mitigate CVE-2026-82005

Immediate Actions Required

Apply the Adobe Photoshop update referenced in APSB26-130 to all workstations running Photoshop Desktop.
Inventory Creative Cloud deployments and confirm that automatic updates are enabled for managed users.
Instruct users to avoid opening Photoshop files received from untrusted sources until the patch is deployed.

Patch Information

Adobe published fixes in security bulletin APSB26-130. Administrators should review the Adobe Photoshop Security Advisory for exact fixed versions and deploy the updates through Adobe Creative Cloud Desktop, Adobe Admin Console, or existing software distribution tools such as Microsoft Intune, Jamf, or SCCM.

Workarounds

Run Photoshop under a standard user account rather than a local administrator to limit the impact of successful exploitation.
Block or quarantine Photoshop file formats received from external senders at the email gateway until systems are patched.
Enforce application allowlisting and script control policies that prevent Photoshop from launching interpreters or unsigned executables.

bash

# Example: verify installed Photoshop version on Windows before/after patching
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s /v ApplicationVersion

# Example: verify installed Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app/Contents/Info.plist" CFBundleShortVersionString