CVE-2026-104348 in Photoshop
Summary
by MITRE • 10/13/2026
Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/13/2026
The Adobe Photoshop Desktop application contains a critical heap-based buffer overflow vulnerability, designated under CVE identifiers such as CVE-2019-5763 and related entries within the 2019 security advisories. This flaw resides in how the software processes specific file formats or data structures during parsing operations. A heap-based buffer overflow occurs when a program writes more data to a buffer located on the heap than it is allocated to hold, causing adjacent memory locations to be overwritten with unintended values. In this context, the vulnerability allows an attacker to corrupt the internal state of the application by supplying specially crafted input that exceeds expected boundaries during file processing routines.
The technical root cause involves insufficient validation of user-supplied data before it is copied into fixed-size buffers within the Photoshop executable or its associated libraries. When a victim opens a maliciously constructed file, potentially disguised as a legitimate image format such as PSD, TIFF, or JPEG, the application attempts to parse the content without adequately checking length constraints or boundary conditions. This lack of rigorous input sanitization enables an attacker to overwrite critical memory structures on the heap, including function pointers or object headers. By carefully crafting the overflow payload, an adversary can manipulate control flow execution paths within the process space.
The operational impact of this vulnerability is severe, as successful exploitation leads to arbitrary code execution in the context of the current user. This means that if a victim interacts with the malicious file by opening it within Photoshop Desktop, the attacker gains full control over the application's memory and can execute commands at the same privilege level as the logged-in user. Depending on system configuration, this could allow for complete compromise of the workstation, installation of malware, theft of sensitive data stored locally, or use of the machine as a pivot point in broader network attacks. The requirement for user interaction lowers the barrier to entry for attackers but does not mitigate the severity once that interaction occurs.
From a classification perspective, this vulnerability aligns with CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) and specifically falls under heap-based variants which are often more complex to exploit due to dynamic memory allocation patterns. It also maps to MITRE ATT&CK techniques related to Initial Access via Spearphishing Attachment or Drive-by Compromise, where the malicious file serves as the delivery mechanism for code execution. The exploitation vector is classified as local with user interaction, emphasizing that social engineering tactics are often required to induce victims into opening the crafted files.
Mitigation strategies primarily involve applying vendor-provided security patches and updates immediately upon release. Adobe regularly releases cumulative updates addressing known vulnerabilities in Photoshop Desktop; ensuring the software version is up-to-date significantly reduces exposure to this specific heap overflow flaw. Additionally, organizations should implement application whitelisting or sandboxing solutions that restrict Photoshop from executing arbitrary code outside of its expected operational parameters. Users must be educated on the risks associated with opening files from untrusted sources and advised to verify file integrity before processing them in professional design applications. Network monitoring tools can also detect anomalous behavior indicative of exploitation attempts, such as unusual memory allocation patterns or unexpected outbound connections following file opens within creative suites.