CVE-2026-104347 in Photoshop
Summary
by MITRE • 10/15/2026
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
Adobe Photoshop Desktop contains a critical memory corruption flaw classified as an out-of-bounds write, which allows for potential arbitrary code execution under specific conditions. This vulnerability stems from improper bounds checking within the application's image processing or file parsing routines. When the software processes certain data structures, it fails to verify that memory writes remain within the allocated boundaries of a buffer. Consequently, if crafted input exceeds these limits, the write operation overwrites adjacent memory locations rather than stopping at the intended boundary. This type of error is fundamentally categorized under CWE-787, which defines out-of-bounds write vulnerabilities as conditions where software writes data to a memory location beyond the end or before the beginning of the intended buffer.
The operational impact of this vulnerability is severe because it can lead to arbitrary code execution in the context of the current user. By carefully crafting malicious input that triggers the overflow, an attacker can overwrite critical control structures such as return addresses on the stack or function pointers within a heap allocation. This manipulation allows the attacker to redirect the program's flow of execution to shellcode injected into memory. Since Adobe Photoshop is typically run with standard user privileges rather than administrative rights, successful exploitation grants the attacker access equivalent to that of the logged-in user. While this limits some systemic damage compared to root-level exploits, it still permits unauthorized data theft, installation of malware, or use of the compromised system as a pivot point for further network attacks.
Exploitation of this vulnerability is not fully automatic and requires significant user interaction. A victim must explicitly open a malicious file that has been crafted to trigger the out-of-bounds write condition. This requirement aligns with ATT&CK technique T1204, which covers User Execution, where an adversary relies on the user opening a specific document or application to initiate the attack chain. The attacker typically distributes these files through phishing campaigns, malicious websites, or compromised legitimate software updates. Once the file is opened within Photoshop Desktop, the vulnerability is triggered during the parsing phase, leading to memory corruption and potentially code execution if exploitation techniques such as heap spraying are successfully employed against modern mitigations like ASLR and DEP.
To mitigate this risk, organizations should ensure that Adobe Photoshop Desktop is updated to the latest version provided by Adobe Systems Incorporated, which includes patches for this specific out-of-bounds write flaw. Administrators should enforce strict software update policies to minimize exposure windows. Additionally, implementing application control solutions can restrict the execution of untrusted scripts or binaries launched from temporary directories often used in such attacks. Users must be educated on social engineering tactics and advised against opening files from unknown sources, particularly those with suspicious extensions or originating from unsolicited communications. Network monitoring tools should also be configured to detect anomalous behavior indicative of exploitation attempts, such as unusual memory access patterns or unexpected process spawns following the opening of image files.