CVE-2026-97312: Adobe Photoshop Desktop RCE Vulnerability

CVE-2026-97312 Overview

CVE-2026-97312 is an out-of-bounds write vulnerability [CWE-787] affecting Adobe Photoshop Desktop. Exploitation can result in arbitrary code execution in the context of the current user. The flaw requires local access and user interaction, meaning a victim must open a crafted file for the attack to succeed. Adobe published the fix in security advisory APSB26-158.

The vulnerability maps to CVSS vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting high impact to confidentiality, integrity, and availability once the malicious document is opened. Attackers typically weaponize such issues through phishing campaigns that deliver poisoned project files to graphic designers and media professionals.

Critical Impact

Successful exploitation grants arbitrary code execution with the privileges of the Photoshop user, enabling malware deployment, credential theft, or lateral movement from the victim workstation.

Affected Products

• Adobe Photoshop Desktop (see Adobe advisory APSB26-158 for exact versions)
• Windows and macOS Photoshop installations prior to the patched release
• Enterprise Creative Cloud deployments distributing Photoshop

Discovery Timeline

• 2026-10-13 - CVE-2026-97312 published to the National Vulnerability Database (NVD)
• 2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-97312

Vulnerability Analysis

The issue is an out-of-bounds write within Photoshop Desktop's file parsing logic. When Photoshop processes a maliciously crafted image or project file, it writes data past the bounds of an allocated buffer. This memory corruption can overwrite adjacent heap metadata, function pointers, or object vtables used by the application.

Attackers who control the overwritten memory can redirect execution flow to attacker-supplied code. The resulting arbitrary code execution runs with the privileges of the current user. On workstations where designers hold local administrator rights, the impact extends to full host compromise.

Adobe has not published root-cause code details publicly. Technical specifics are limited to the vendor advisory at Adobe Photoshop Security Advisory APSB26-158.

Root Cause

The root cause is improper validation of input data during file parsing. Length or offset fields inside the malicious file are trusted without bounds checking, causing the parser to write beyond the allocated destination buffer. Vulnerabilities classified under [CWE-787] frequently stem from arithmetic errors on size fields or missing checks on attacker-controlled indices.

Attack Vector

Exploitation requires the attacker to deliver a malicious file to the victim and convince them to open it in Photoshop. Common delivery channels include spear-phishing emails, compromised asset-sharing platforms, and poisoned stock-image repositories. The attack is local in scope but easily initiated through standard social engineering.

No authentication is required, and the attack complexity is low once the user opens the file. Public proof-of-concept code is not available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-97312

Indicators of Compromise

• Unexpected child processes spawned by Photoshop.exe such as cmd.exe, powershell.exe, or rundll32.exe
• Photoshop process crashes or exception events in Windows Event Log immediately after opening a user-supplied file
• Outbound network connections initiated by Photoshop to unknown hosts shortly after file open
• Creation of executable files or scheduled tasks under the user profile after Photoshop activity

Detection Strategies

• Monitor for anomalous process trees originating from Photoshop and alert on execution of scripting interpreters or LOLBins
• Track file writes by Photoshop to directories outside normal project paths (for example %APPDATA%, %TEMP%, startup folders)
• Correlate email or download gateway telemetry with Photoshop file-open events to identify suspicious delivery

Monitoring Recommendations

• Enable detailed process creation logging (Windows Event ID 4688, macOS Endpoint Security) and ship to a centralized SIEM
• Baseline normal Photoshop network activity and alert on deviations such as connections to non-Adobe infrastructure
• Hunt retroactively for Photoshop crash signatures across endpoints to identify prior exploitation attempts

How to Mitigate CVE-2026-97312

Immediate Actions Required

• Apply the Adobe Photoshop update referenced in advisory APSB26-158 across all affected workstations
• Inventory Creative Cloud deployments to confirm patched versions are installed on both Windows and macOS endpoints
• Instruct users not to open Photoshop files received from untrusted sources until patching is complete

Patch Information

Adobe released patched builds alongside the Adobe Photoshop Security Advisory APSB26-158. Administrators should push the update through Adobe Admin Console or Creative Cloud Desktop. Verify installed Photoshop versions after deployment and track outstanding endpoints through your endpoint management platform.

Workarounds

• Restrict Photoshop file handling to files originating from trusted internal sources until patches are deployed
• Remove local administrator privileges from standard users to limit the blast radius of user-context code execution
• Use application allow-listing to prevent Photoshop from launching child processes such as shells and script interpreters

# Verify installed Adobe Photoshop version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "Adobe Photoshop*" } |
  Select-Object DisplayName, DisplayVersion, InstallDate