CVE-2026-96522: Adobe Photoshop Desktop RCE Vulnerability

CVE-2026-96522 Overview

CVE-2026-96522 is an out-of-bounds write vulnerability [CWE-787] in Adobe Photoshop Desktop. Attackers who craft a malicious file can trigger arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open the attacker-supplied file in Photoshop. Adobe published details in Security Bulletin APSB26-158.

The flaw allows attackers to compromise user accounts, access files the user can read, and establish initial footholds for lateral movement. Because Photoshop handles complex file formats routinely shared between creative teams and external parties, phishing and supply-chain delivery vectors are realistic.

Critical Impact

A crafted Photoshop file opened by a victim can execute arbitrary code with the user's privileges, enabling data theft and persistence.

Affected Products

• Adobe Photoshop Desktop (see Adobe Security Bulletin APSB26-158 for affected versions)
• Windows and macOS installations of Photoshop Desktop
• Environments where users process untrusted image or project files

Discovery Timeline

• 2026-10-13 - CVE-2026-96522 published to NVD
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96522

Vulnerability Analysis

The vulnerability is an out-of-bounds write condition classified under [CWE-787]. Photoshop writes data past the bounds of an allocated memory buffer while parsing a malformed file. This corruption of adjacent memory structures gives attackers a primitive they can shape into arbitrary code execution.

The attack vector is local: the attacker does not need network access to the target system. Instead, exploitation depends on social engineering to deliver the malicious file and convince the victim to open it. Once Photoshop parses the file, the out-of-bounds write triggers, and attacker-controlled data overwrites memory used for control flow.

Successful exploitation yields code execution with the privileges of the user running Photoshop. On typical workstations, that user holds rights to documents, cloud storage tokens, browser session data, and local development assets. Attackers can stage follow-on tooling, exfiltrate project files, or move laterally using the user's cached credentials.

Root Cause

The root cause is insufficient bounds checking in a file parser inside Photoshop Desktop. When the parser processes crafted field values or chunk sizes in a malicious file, it writes beyond the end of a buffer. Adobe has not published parser-level technical detail. Refer to Adobe Security Bulletin APSB26-158 for the authoritative advisory.

Attack Vector

An attacker crafts a malicious image or project file and delivers it through email, chat, shared drives, or compromised asset libraries. The victim opens the file in a vulnerable Photoshop Desktop build. Parsing triggers the out-of-bounds write, and the attacker's payload runs under the victim's user context. No elevated privileges or prior authentication are required.

No public proof-of-concept exploit is available at publication time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-96522

Indicators of Compromise

• Unexpected child processes spawned by Photoshop.exe or Adobe Photoshop on macOS, especially shells, scripting engines, or rundll32.
• Photoshop process crashes or Windows Error Reporting entries referencing image file parsing modules.
• Outbound network connections from the Photoshop process to untrusted hosts shortly after a file open event.
• Creation of executable files or scheduled tasks by the Photoshop process.

Detection Strategies

• Alert on process-lineage anomalies where Photoshop launches interpreters such as powershell.exe, cmd.exe, wscript.exe, bash, or osascript.
• Hunt for file-write events from Photoshop into autorun, startup, or LaunchAgents locations.
• Correlate email or messaging delivery of .psd, .psb, .tiff, or related files with subsequent suspicious Photoshop activity.

Monitoring Recommendations

• Collect endpoint process, file, and network telemetry from workstations running Adobe Creative Cloud applications.
• Monitor Adobe Creative Cloud update status to confirm all endpoints receive the APSB26-158 patch.
• Review proxy and DNS logs for new or unusual egress from creative team workstations.

How to Mitigate CVE-2026-96522

Immediate Actions Required

• Apply the Photoshop Desktop update referenced in Adobe Security Bulletin APSB26-158 across all affected endpoints.
• Inventory systems running Photoshop Desktop and prioritize patching for users who routinely open externally sourced files.
• Instruct users to avoid opening Photoshop files from untrusted senders until patching completes.

Patch Information

Adobe addressed CVE-2026-96522 in the Photoshop Desktop update described in Security Bulletin APSB26-158. Deploy the fixed version through Adobe Creative Cloud or your enterprise software distribution system. Verify installed versions match or exceed the fixed build listed in the advisory.

Workarounds

• Block or quarantine Photoshop file attachments at the email gateway for high-risk user groups.
• Enforce application allowlisting to prevent Photoshop from launching unexpected child processes.
• Run Photoshop under standard user accounts rather than administrators to limit post-exploitation impact.

# Verify Photoshop version on macOS
defaults read "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app/Contents/Info.plist" CFBundleShortVersionString

# Verify Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Photoshop*" } |
  Select-Object DisplayName, DisplayVersion