An out-of-bounds write flaw in Adobe Photoshop Desktop allows an attacker to corrupt memory while processing a crafted graphics file. If successfully triggered, the vulnerability can cause arbitrary code execution under the current user’s security context. The flaw is characterized by CWE-787 and is present in all releases of the desktop product as indicated by the security advisory.

Adobe Photoshop Desktop, sold under the Adobe brand, is affected. No specific version ranges are provided in the advisory, so all currently released desktop builds should be considered vulnerable until patch information is released.

The CVSS score is 7.8, indicating a high severity threat. Exploitation requires user-initiated opening of a malicious file, which lowers the chances of stealthy attacks but still allows opportunistic attempts. The EPSS score is < 1%, reflecting a very low but non-zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The lack of mitigation guidance suggests that the attack potential remains significant if the flaw is not fixed.