CVE-2026-75631 in Photoshop
Summary
by MITRE • 09/08/2026
Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/08/2026
The Adobe Photoshop Desktop application contains a critical memory corruption flaw classified as an out-of-bounds write vulnerability, which poses a severe risk to system integrity and confidentiality. This specific type of defect occurs when the software attempts to write data to a memory location that lies outside the boundaries of the intended buffer or allocated memory region. In the context of Adobe Photoshop, this likely stems from improper validation of input parameters related to image processing operations, file parsing routines, or plugin interactions. When an attacker crafts a malicious file with specially constructed headers or embedded payloads, they can manipulate internal pointers or array indices within the application's codebase. This manipulation causes the program to overwrite adjacent memory locations that may contain critical control data such as return addresses on the stack, function pointers in heap metadata, or other executable structures. The presence of this vulnerability indicates a failure in boundary checking mechanisms during the handling of complex file formats or specific image processing commands, allowing an attacker to gain unauthorized write access to arbitrary memory regions.
The operational impact of exploiting this out-of-bounds write is significant, as it can lead directly to arbitrary code execution within the security context of the currently logged-in user. Unlike vulnerabilities that merely cause application crashes or denial of service, a successful exploitation allows an adversary to inject and execute malicious instructions on the victim's machine. This capability enables a wide range of post-exploitation activities including data theft, installation of additional malware such as ransomware or keyloggers, lateral movement within a network if the user has elevated privileges, and complete compromise of the workstation. The requirement for user interaction means that this vulnerability is typically exploited via social engineering tactics where an unsuspecting victim opens a malicious file disguised as a legitimate Photoshop project, template, or plugin package. Once opened, the application processes the malformed input, triggering the memory corruption sequence without any further action from the user. This attack vector aligns with common techniques observed in targeted attacks against creative professionals and enterprises relying on Adobe products for daily operations.
From a threat intelligence perspective, this vulnerability maps to CWE-787: Out-of-bounds Write within the Common Weakness Enumeration framework, which highlights the fundamental programming error of accessing memory beyond allocated limits. Furthermore, the exploitation path corresponds to ATT&CK technique T1203: Exploitation for Client Execution, where attackers leverage software vulnerabilities in client applications to execute code on target systems. The reliance on user interaction places this vulnerability within the initial access kill chain phase, emphasizing the importance of both technical controls and security awareness training. To mitigate these risks, organizations must ensure that Adobe Photoshop is updated to the latest version released by Adobe Systems Incorporated, which includes patches for known memory safety issues. Administrators should enforce strict software update policies across all workstations running creative suites. Additionally, implementing application whitelisting or sandboxing solutions can restrict the ability of untrusted files to trigger complex processing routines within the host environment. Security teams should also monitor for unusual process creation events originating from Photoshop instances that may indicate exploitation attempts in real-time.