Photoshop Desktop has an incorrect authorization flaw that allows an attacker to execute arbitrary code as the logged‑in user. The vulnerability can be triggered by opening a specially crafted file, giving the attacker the ability to run malicious instructions and potentially modify or expose user data. It is a scope‑changing flaw, meaning the attacker can affect resources beyond the initially targeted file.

Adobe Photoshop Desktop is affected. The vendor is Adobe. Specific product families include Photoshop, but no particular version ranges were listed in the CNA data, so all current installations remain at risk until updated.

The CVSS score of 8.6 labels the issue as high severity. EPSS is listed as less than 1%, indicating that exploitation is currently rare, but the vulnerability is not in CISA’s KEV catalog. Because the flaw requires a victim to open a malicious file, the attack vector is user interaction, but the impact once executed can be far‑reaching due to the authorized context.