Photoshop Desktop is vulnerable to an out-of-bounds write that can lead to arbitrary code execution in the context of the user. This flaw occurs when the application processes a crafted file, writing data beyond its allocated buffer and corrupting adjacent memory. The result is that an attacker can have the program execute injected code with the permissions of the current user.

Adobe Photoshop Desktop. No specific version range was provided in the advisory; users should review Adobe’s release notes to determine whether their installed build includes the fix.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1 % indicates a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. Exploitation requires user interaction – the victim must open a malicious file – so remote exploitation is not supported.