An out‑of‑bounds memory write in Adobe Photoshop Desktop can be triggered by opening a specially crafted file, allowing an attacker to inject code that executes with the privileges of the current user. The vulnerability is identified as CWE‑787. When exploited, the attacker can run arbitrary commands, access local data, or pivot into the system. The flaw is driven by a failure to correctly validate array bounds during file parsing. No other component of the system is directly involved.

The flaw affects Adobe Photoshop Desktop, all variants that have not applied the Adobe APSB26‑158 update. No specific product versions are listed, so all installations of Photoshop Desktop remain at risk until the patch is installed.

The CVSS score of 7.8 indicates a high impact and moderate‑to‑high exploitation risk. The EPSS score of <1% suggests that the probability of exploitation in the wild is low, and the vulnerability is not yet catalogued in CISA's KEV list. However, because the attack requires only user interaction—opening a malicious file—the vulnerability can be abused by sending infected files through email, messaging, or the web. The attack vector is client‑side, and successful exploitation would let the attacker execute code with the victim’s privileges.