{"id":"CVE-2026-113571","kind":"vulnerability","aliases":["CVE-2026-113571"],"related":[],"title":"Photoshop Desktop: malicious file crashes the app via null pointer dereference","description":"Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has a null pointer dereference that a crafted file can trigger. An attacker who gets a victim to open that file can crash the application, causing a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","desktop","other","photoshop"],"not_affected_if":["no-untrusted-files"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:50+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","triaged_at":"2026-11-10T21:49:48+00:00","updated_at":"2026-11-10T21:49:48+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T21:49:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: malicious file crashes the app via null pointer dereference","impact":"low","summary":"Adobe Photoshop Desktop has a null pointer dereference that a crafted file can trigger. An attacker who gets a victim to open that file can crash the application, causing a denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"application crashes and stops responding for the user","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Anyone running Photoshop Desktop who opens files from untrusted sources may have the application crash. The sources do not name affected versions or say which file types trigger it. unknown","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000639,"input_tokens":4557,"output_tokens":366,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113571':14A,17A '-2026':13A,16A 'adob':18B,22B 'affect':58C 'app':7A 'applic':49B,70C,84C 'attack':37B,76C 'caus':50B 'condit':92C 'could':66C,77C 'craft':32B 'crash':5A,47B,82C 'cve':12A,15A 'denial':52B,72C,89C 'denial-of-servic':71C,88C 'derefer':11A,29B,63C 'desktop':2A,19B,24B,56C 'exploit':78C,93C 'file':4A,33B,45B,108C 'get':39B 'interact':99C 'issu':96C 'lead':85C 'malici':3A,107C 'must':104C 'null':9A,27B,61C 'open':43B,105C 'photoshop':1A,21B,23B,55C 'pointer':10A,28B,62C 'requir':97C 'result':67C 'servic':54B,74C,91C 'trigger':35B 'user':98C 'via':8A 'victim':41B,103C 'vulner':64C,80C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Photoshop Desktop who opens files from untrusted sources may have the application crash. The sources do not name affected versions or say which file types trigger it. unknown","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobe","desktop","medium","other","photoshop"],"campaign_type":null,"search_a":"'-113571':14A,17A '-2026':13A,16A 'app':7A 'crash':5A 'cve':12A,15A 'derefer':11A 'desktop':2A 'file':4A 'malici':3A 'null':9A 'photoshop':1A 'pointer':10A 'via':8A","search_b":"'adob':18B,22B 'applic':49B 'attack':37B 'caus':50B 'craft':32B 'crash':47B 'denial':52B 'derefer':29B 'desktop':19B,24B 'file':33B,45B 'get':39B 'null':27B 'open':43B 'photoshop':21B,23B 'pointer':28B 'servic':54B 'trigger':35B 'victim':41B","search_c":"'affect':58C 'applic':70C,84C 'attack':76C 'condit':92C 'could':66C,77C 'crash':82C 'denial':72C,89C 'denial-of-servic':71C,88C 'derefer':63C 'desktop':56C 'exploit':78C,93C 'file':108C 'interact':99C 'issu':96C 'lead':85C 'malici':107C 'must':104C 'null':61C 'open':105C 'photoshop':55C 'pointer':62C 'requir':97C 'result':67C 'servic':74C,91C 'user':98C 'victim':103C 'vulner':64C,80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113571","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113571","severity":null,"published_at":"2026-11-10T21:18:50+00:00","modified_at":"2026-11-10T21:18:51+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","fetched_at":"2026-11-10T21:46:13+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}