This vulnerability is an out‑of‑bounds write in Adobe Photoshop Desktop that can lead to arbitrary code execution in the context of the user who opens a malicious file. The flaw is a classic memory corruption error, classified under CWE‑787. An attacker must supply crafted content—a file that a victim opens—to trigger the issue. Once executed, the attacker could gain full control of the user’s system, steal data, install malware, or perform other malicious actions.

Adobe Photoshop Desktop users are impacted. No specific version information is supplied, so all installed versions may be vulnerable until they receive an update. Administrators should review the Adobe Security Advisory for the exact affected releases and apply the recommended fix.

The vulnerability carries a CVSS score of 7.8, indicating a high severity. The EPSS score is 0.00158, indicating a very low probability of exploitation, but the requirement of user interaction limits the threat to environments where users routinely open untrusted files. The issue is not listed in CISA’s KEV catalog, suggesting no public evidence of widespread exploitation yet. Given the potential for remote code execution and the need for a malicious file, organizations should prioritize remediation.