An out-of-bounds write in Photoshop Desktop allows an attacker to overwrite memory, potentially leading to arbitrary code execution under the victim’s user account. The vulnerability (CWE-787) could let malicious code run when a user opens a fabricated file.

Adobe Photoshop on desktop platforms. Specific affected versions are not disclosed in the public advisory, so all installations that were not updated after the release of the fix should be considered vulnerable.

The CVSS score of 7.8 indicates high severity, but the EPSS score of less than 1% suggests the likelihood of exploitation is low at present. The vulnerability does not appear in CISA’s KEV catalog, and the attack vector requires the victim to open a malicious file, meaning that user interaction is needed. Overall, the risk to unpatched systems remains moderate, emphasizing the importance of patching.