An out-of-bounds read in Adobe Photoshop Desktop allows a crafted file to trigger a read past the end of an allocated memory structure. This flaw can be exploited to execute arbitrary code with the privileges of the user who opens the file, effectively leading to remote code execution. The vulnerability is triggered only when a victim opens a malicious file, meaning user interaction is required.

Adobe Photoshop Desktop versions 27.4 and earlier are affected. All later versions are not impacted. The flaw applies across all platforms that run Photoshop Desktop, as the vendor’s advisory lists the product line rather than specific operating systems.

The CVSS score of 7.8 indicates a high severity. Exploitation requires user interaction, reducing the likelihood of automated attacks, yet the high score and potential to gain code execution make this a serious risk. No exploitation is listed in CISA’s KEV catalog, and no EPSS score is available, so the current exploitation trend is unclear, but the vulnerability remains dangerous until patched.