CVE-2026-95635 in Photoshop
Summary
by MITRE • 10/14/2026
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/14/2026
The Adobe Photoshop Desktop application is susceptible to a critical memory management flaw classified as a Double Free vulnerability, which poses a severe risk to system integrity and confidentiality. This specific type of error occurs when the same block of dynamically allocated memory is freed more than once by the software during its execution lifecycle. In standard programming practices, freeing memory twice leads to undefined behavior because the first deallocation marks the memory region as available for reuse, while the second attempt attempts to release it again, potentially corrupting internal data structures such as heap metadata or linked lists that manage memory allocation. This corruption creates an opportunity for attackers to manipulate how subsequent memory allocations are handled by the application's runtime environment.
From a technical perspective, this vulnerability falls under Common Weakness Enumeration category CWE-415, which defines Double Free errors. The exploitation mechanism relies on carefully crafted input data, typically in the form of malicious image files or project documents that trigger specific code paths within Photoshop’s parsing engine. When an unsuspecting user opens such a file, the application processes its contents and inadvertently triggers the double free condition. This memory corruption can be leveraged to overwrite function pointers or object vtables with attacker-controlled data. By controlling these overwritten values, an adversary gains the ability to redirect program execution flow to arbitrary shellcode injected into the process memory space.
The operational impact of this vulnerability is significant due to its potential for Remote Code Execution (RCE). If successfully exploited, the malicious code executes within the security context of the currently logged-in user account. This means that if a standard user runs Photoshop and opens the crafted file, they could inadvertently install malware, steal sensitive documents stored on their local machine, or use their compromised workstation as a pivot point for further network attacks. The requirement for user interaction, specifically opening a malicious file, aligns with ATT&CK technique T1204, which covers User Execution. This indicates that while the vulnerability is high-severity due to its code execution potential, it requires social engineering or phishing tactics to deliver the payload effectively, as automatic exploitation without user action is not feasible in this specific scenario.
Mitigation strategies must focus on both immediate remediation and long-term defensive posture improvements. The primary defense is to apply the latest security patches provided by Adobe immediately upon release, as these updates typically include code changes that validate memory pointers before deallocation or utilize safe memory management libraries that prevent double frees from occurring. Additionally, organizations should enforce strict application whitelisting policies to ensure only verified versions of Photoshop are executed on corporate endpoints. Users must be educated about the risks associated with opening files from untrusted sources, particularly those received via email attachments or downloaded links, as this vulnerability relies heavily on user interaction for successful exploitation. Implementing endpoint detection and response solutions that monitor for anomalous memory access patterns can also help detect attempted exploits in real-time before full code execution occurs.