Description
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Arbitrary code execution in the context of the current user due to a double free in Adobe Photoshop Desktop
Action: Immediate Patch
AI Analysis

Impact

Adobe Photoshop Desktop suffers from a double free bug, which allows a crafted file to trigger a double free condition and lead to arbitrary code execution when the file is opened. The flaw permits attackers to run malicious code on the victim’s machine with the credentials of the user who opens the file.

Affected Systems

Adobe Photoshop Desktop software is impacted. The vendor products listed are Adobe:Photoshop, but no specific versions are provided. Transition to a patched or newer release is required.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8 and an EPSS score of less than 1%, indicating a high severity yet low likelihood of exploitation today. It is not listed in CISA’s KEV catalog. Exploitation requires user interaction – the victim must open a malicious file. Attackers would need to acquire a malicious file via email, web download, or social engineering, after which the double free could be triggered to obtain code execution.

Generated by OpenCVE AI on October 16, 2026 at 03:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update Adobe Photoshop to the latest patched version as announced in Adobe’s security advisory.
  • If an immediate update is not possible, block or quarantine known malicious file types and restrict the ability to open unknown files without user confirmation.
  • Monitor the system for suspicious file openings or anomalous behavior that may indicate exploitation attempts.

Generated by OpenCVE AI on October 16, 2026 at 03:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
First Time appeared Apple
Apple macos
Microsoft
Microsoft windows
CPEs cpe:2.3:a:adobe:photoshop:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
Vendors & Products Apple
Apple macos
Microsoft
Microsoft windows

Sun, 18 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Adobe
Adobe photoshop
Vendors & Products Adobe
Adobe photoshop

Wed, 14 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
Description Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Title Photoshop Desktop | Double Free (CWE-415)
Weaknesses CWE-415
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

Subscriptions

Adobe Photoshop
Apple Macos
Microsoft Windows
cve-icon MITRE

Status: PUBLISHED

Assigner: adobe

Published:

Updated: 2026-10-14T10:40:50.752Z

Reserved: 2026-09-22T11:06:57.165Z

Link: CVE-2026-95635

cve-icon Vulnrichment

Updated: 2026-10-14T10:39:19.313Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T21:19:58.603

Modified: 2026-10-22T17:53:01.593

Link: CVE-2026-95635

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-18T20:15:14Z

Weaknesses