CVE-2026-96523: Photoshop Desktop RCE Vulnerability

CVE-2026-96523 Overview

CVE-2026-96523 is an out-of-bounds write vulnerability [CWE-787] in Adobe Photoshop Desktop. The flaw allows arbitrary code execution in the context of the current user when a victim opens a crafted malicious file. Exploitation requires local user interaction, limiting mass exploitation but creating risk in targeted attacks against designers, media teams, and creative professionals who routinely handle files from external sources.

Adobe published the advisory on October 13, 2026. No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact

Opening a malicious Photoshop file can trigger arbitrary code execution with the privileges of the current user, enabling full endpoint compromise.

Affected Products

• Adobe Photoshop Desktop (see Adobe security bulletin APSB26-158 for affected version ranges)
• Windows installations of Photoshop Desktop
• macOS installations of Photoshop Desktop

Discovery Timeline

• 2026-10-13 - CVE-2026-96523 published to NVD and Adobe releases security bulletin APSB26-158
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-96523

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Adobe Photoshop Desktop's file parsing logic. When Photoshop processes a specially crafted image or project file, the application writes data past the bounds of an allocated buffer. This corruption of adjacent memory can be shaped by an attacker to overwrite function pointers, virtual table entries, or control-flow data.

Successful exploitation yields arbitrary code execution in the user's security context. On systems where the operator holds administrative rights, this translates to full host compromise. On standard user accounts, attackers gain a foothold suitable for credential theft, lateral movement, or follow-on privilege escalation.

The attack surface is local, and user interaction is required. Delivery typically occurs through phishing, watering-hole downloads, or supplied project files from untrusted collaborators.

Root Cause

The root cause is improper validation of input dimensions or length fields during parsing of a Photoshop-supported file format [CWE-787]. The code calculates a destination buffer size using attacker-controlled metadata without enforcing bounds checks before the write operation. Adobe has not published the specific parser or file format component responsible.

Attack Vector

An attacker crafts a malicious file in a format Photoshop opens, such as .psd, .psb, or an associated raster format. The file is delivered through email attachment, cloud share, or compromised asset repository. When the victim opens the file in Photoshop, the parser triggers the out-of-bounds write and attacker-controlled code executes.

For exploitation details and parser specifics, consult the Adobe Security Update for Photoshop (APSB26-158).

Detection Methods for CVE-2026-96523

Indicators of Compromise

• Photoshop process (Photoshop.exe on Windows, Adobe Photoshop on macOS) spawning unexpected child processes such as cmd.exe, powershell.exe, wscript.exe, or shell interpreters
• Unexpected network connections initiated by the Photoshop process to unknown external hosts shortly after file open
• Crash dumps or Windows Error Reporting events referencing access violations in Photoshop image parsing modules

Detection Strategies

• Monitor process-lineage telemetry for Photoshop acting as a parent to scripting hosts, LOLBins, or file-write operations outside typical project directories
• Alert on Photoshop writing executable files (.exe, .dll, .scr, .ps1) to disk or modifying autorun registry locations
• Flag Photoshop opening files sourced from browser downloads, email client temp directories, or removable media

Monitoring Recommendations

• Collect and retain EDR process-creation, file-write, and network-connection events for Photoshop binaries
• Enable Windows Defender Exploit Guard or equivalent exploit mitigations for Photoshop.exe and inspect blocked-event logs
• Track Photoshop version strings across the fleet through software inventory to confirm patch deployment status

How to Mitigate CVE-2026-96523

Immediate Actions Required

• Apply the updates referenced in Adobe security bulletin APSB26-158 to all Photoshop Desktop installations
• Inventory endpoints running Photoshop and prioritize patching for users who regularly open externally sourced files
• Instruct users to avoid opening Photoshop files received from untrusted senders or unverified sources until patching is complete

Patch Information

Adobe published fixed versions in bulletin APSB26-158. Deploy the updated Photoshop release through the Adobe Creative Cloud desktop application or an enterprise software distribution system. Confirm the installed build matches the fixed version listed in the Adobe advisory.

Workarounds

• Restrict Photoshop file handling to trusted sources through email gateway policies that quarantine .psd and .psb attachments from external senders
• Run Photoshop under standard user accounts rather than administrative accounts to limit the impact of code execution
• Enforce application allowlisting to prevent Photoshop from spawning scripting interpreters or writing executable content

# Verify installed Photoshop version on macOS
mdls -name kMDItemVersion "/Applications/Adobe Photoshop 2026/Adobe Photoshop 2026.app"

# Verify installed Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Photoshop*" } |
  Select-Object DisplayName, DisplayVersion