An out-of-bounds write vulnerability in Adobe Photoshop Desktop can allow an attacker to execute arbitrary code while the application is running. The flaw is triggered when the program processes a maliciously crafted document and does not require any authentication or elevated privileges. Because the code runs with the victim’s user permissions, the attacker could read, modify, or delete local data and potentially install additional malware. This can compromise the confidentiality, integrity, and availability of the affected system.

The affected product is Adobe Photoshop Desktop. No specific version information is available in the advisory, so any installation of Photoshop Desktop may be impacted until a vendor patch is applied.

The CVSS score of 7.8 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalogue, meaning no known widespread attacks have been reported. Successful exploitation requires user interaction – a victim must open a malicious file. When the file is opened, the attacker can achieve arbitrary code execution, potentially taking full control over the user session. Based on the description, the likely attack vector is the victim opening a malicious document.