CVE-2026-95640: Photoshop Desktop DOS Vulnerability

CVE-2026-95640 Overview

CVE-2026-95640 is a NULL pointer dereference vulnerability [CWE-476] affecting Adobe Photoshop Desktop. An attacker can craft a malicious file that, when opened by a victim, triggers the dereference and crashes the application. The flaw results in a denial-of-service condition against the local Photoshop process. Exploitation requires user interaction because the victim must open the attacker-supplied file. The issue does not expose confidential data or allow modification of system state. Adobe published the corresponding security update in advisory APSB26-158.

Critical Impact
A specially crafted file opened in Photoshop Desktop causes an application crash, interrupting user workflows and potentially corrupting unsaved work.

Affected Products

Adobe Photoshop Desktop (versions covered by advisory APSB26-158)
Windows installations of Photoshop Desktop
macOS installations of Photoshop Desktop

Discovery Timeline

2026-10-13 - CVE-2026-95640 published to the National Vulnerability Database
2026-10-14 - Entry last modified in NVD

Technical Details for CVE-2026-95640

Vulnerability Analysis

The vulnerability is a NULL pointer dereference inside Adobe Photoshop Desktop's file parsing path. When Photoshop processes a malformed input file, a code path reads from a pointer that was never initialized or was set to NULL after a failed allocation or lookup. Dereferencing that pointer triggers an access violation and terminates the process. The flaw yields a denial-of-service outcome; the Common Weakness Enumeration classification is [CWE-476]. The attack is local in scope because the attacker cannot reach the vulnerable code without the victim opening the crafted file in Photoshop.

Root Cause

The root cause is missing validation of a pointer before use within Photoshop's file handling logic. A parser routine assumes an upstream function returned a valid object reference. When a crafted file causes that upstream function to return NULL — for example, due to an unexpected header field, chunk length, or missing resource — subsequent code dereferences the pointer without a guard, producing a segmentation fault on macOS or an access violation on Windows.

Attack Vector

Exploitation requires the victim to open a malicious file in Photoshop. An attacker delivers the file through email, a shared drive, a chat application, or a download. Once opened, the parser hits the NULL pointer path and the application exits. The attacker gains no code execution, no privilege escalation, and no data access. The impact is limited to availability of the Photoshop process on the victim's workstation. Repeated delivery of the file can be used to persistently disrupt a user's work.

No verified proof-of-concept code is published. See the Adobe Photoshop Security Update for technical details.

Detection Methods for CVE-2026-95640

Indicators of Compromise

Unexpected Photoshop process termination shortly after a user opens a file received from an external source.
Windows Application Event Log entries showing Photoshop.exe faulting with exception code 0xC0000005 (access violation).
macOS crash reports in ~/Library/Logs/DiagnosticReports/ referencing Adobe Photoshop and a EXC_BAD_ACCESS (SIGSEGV) signal.

Detection Strategies

Alert on repeated Photoshop crashes on the same endpoint within a short window, which indicates a user repeatedly reopening a malicious file.
Correlate email or messaging platform delivery of Photoshop file formats (.psd, .psb, .pdd) from untrusted senders with subsequent application crashes.
Hunt for crash telemetry across endpoints where the same file hash was opened by multiple users.

Monitoring Recommendations

Forward Windows Application and macOS unified log crash events to your SIEM for Adobe Photoshop processes.
Track the installed Photoshop build on managed endpoints and flag versions below the fixed release in APSB26-158.
Monitor file-sharing and email gateways for Photoshop project files originating from external domains.

How to Mitigate CVE-2026-95640

Immediate Actions Required

Apply the Photoshop Desktop update referenced in Adobe advisory APSB26-158 across all managed workstations.
Instruct users to avoid opening Photoshop files received from untrusted senders until patching completes.
Enable automatic updates in the Adobe Creative Cloud desktop client to accelerate deployment.

Patch Information

Adobe published fixed Photoshop Desktop versions in Adobe Photoshop Security Update APSB26-158. Deploy the vendor-supplied update through Adobe Creative Cloud or your enterprise software distribution system. Verify the installed build on each endpoint matches or exceeds the fixed version listed in the advisory.

Workarounds

Open suspicious Photoshop files only in an isolated virtual machine or sandboxed account until patching is complete.
Use email and web gateway controls to quarantine Photoshop file formats from untrusted external senders.
Encourage users to save work frequently and enable Photoshop's AutoSave to limit productivity loss from unexpected crashes.

bash

# Configuration example: query installed Photoshop version on Windows
reg query "HKLM\SOFTWARE\Adobe\Photoshop" /s /v ApplicationVersion

# macOS: query installed Photoshop version
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app"