CVE-2026-104346 in Photoshop
Summary
by MITRE • 10/13/2026
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The Adobe Photoshop Desktop application contains a critical memory corruption flaw classified as an out-of-bounds write, which poses a severe risk to system integrity and confidentiality. This vulnerability arises from improper validation of boundary conditions when processing specific image data structures within the software's rendering engine or plugin architecture. When the application processes a crafted file containing malformed metadata or pixel data arrays, it fails to correctly calculate memory offsets before writing data to allocated buffers. Consequently, this allows an attacker to write data beyond the intended boundaries of the buffer, overwriting adjacent memory regions that may contain control flow information such as return addresses or function pointers. This type of flaw is fundamentally categorized under CWE-787: Out-of-bounds Write in standard vulnerability classification systems, representing a classic heap-based corruption scenario where precise memory manipulation leads to arbitrary code execution potential.
The operational impact of this vulnerability is significant because it directly compromises the security boundary of the user running the application. If successfully exploited, an attacker can achieve arbitrary code execution within the context of the current user account. This means that any files accessed by Photoshop, such as documents stored in local directories or cloud-synced folders, become accessible to the adversary. Furthermore, if the user operates with administrative privileges, the compromise could escalate to full system control, allowing for persistent backdoors, credential theft via keyloggers or browser data extraction, and lateral movement within a corporate network. The attack vector is classified as remote through local file execution under MITRE ATT&CK framework techniques T1203: Exploitation for Client Execution, specifically leveraging the trust relationship between the user and the application to bypass initial access controls without requiring elevated privileges at the point of exploitation.
Exploiting this vulnerability requires direct user interaction, which serves as a primary defense mechanism but is often circumvented through social engineering tactics. A victim must open or import a maliciously crafted file that triggers the out-of-bounds write condition during parsing or rendering. Attackers typically disguise these files with legitimate extensions such as PSD, JPEG, or TIFF to evade basic detection mechanisms and encourage users to interact with them under the assumption of safety. The reliance on user interaction highlights the importance of application whitelisting and macro restrictions in enterprise environments, although modern exploitation techniques increasingly focus on automating this step through browser-based delivery chains or bundled installers that trigger Photoshop's file handling routines automatically upon execution.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The most effective countermeasure is the prompt application of vendor-provided security patches that correct the boundary checks within the image processing libraries. Organizations should enforce strict update policies to ensure all instances of Adobe Photoshop are running versions with these fixes applied. Additionally, implementing Application Control technologies such as Windows Defender Application Control or AppLocker can prevent unauthorized scripts from executing and restrict Photoshop from accessing untrusted directories. Network segmentation limits the blast radius if a workstation is compromised by isolating sensitive data stores from general user workstations. Finally, security awareness training should emphasize caution when opening files received via email or downloaded from unverified sources, reinforcing that even trusted applications like creative suites are susceptible to memory corruption attacks when processing maliciously crafted inputs.