{"id":"CVE-2026-113575","kind":"vulnerability","aliases":["CVE-2026-113575"],"related":[],"title":"Photoshop Desktop: heap buffer overflow lets a malicious file run code","description":"Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has a heap-based buffer overflow that can be triggered by opening a crafted file. An attacker who gets a victim to open that file can run arbitrary code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","macos","other","photoshop","user-interaction","windows"],"not_affected_if":["photoshop-not-installed"],"how_to_check":"Open Photoshop > Help > About (or Creative Cloud app) and note the version. Adobe's November 2026 bulletin for this CVE was not found, so the affected range is unconfirmed; the October bulletin APSB26-158 fixed 27.11 / 26.11.8, so older builds are likely exposed.","fix":null,"status":"open","published_at":"2026-11-10T21:18:51+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","triaged_at":"2026-11-10T21:47:59+00:00","updated_at":"2026-11-10T21:54:34+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T21:47:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: heap buffer overflow lets a malicious file run code","impact":"high","summary":"Adobe Photoshop Desktop has a heap-based buffer overflow that can be triggered by opening a crafted file. An attacker who gets a victim to open that file can run arbitrary code as the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","windows","macos"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the logged-in user after opening a file","analyst_note":"Find the affected and fixed Photoshop versions and Adobe's bulletin for CVE-2026-113575.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["photoshop-not-installed"],"who_is_affected":"Teams that run Adobe Photoshop Desktop on workstations and open files from outside sources are exposed. The sources do not name affected versions. Systems that do not have Photoshop installed can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000665,"input_tokens":4538,"output_tokens":422,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed Photoshop versions and Adobe's bulletin for CVE-2026-113575.","search":"'-113575':14A,17A '-2026':13A,16A 'adob':18B,26B 'affect':66C 'arbitrari':57B,79C 'attack':46B 'base':33B,71C 'buffer':4A,34B,72C 'code':11A,58B,80C 'context':84C 'could':76C 'craft':43B 'current':61B,87C 'cve':12A,15A 'desktop':2A,28B,64C 'execut':81C 'exploit':89C 'file':9A,44B,54B,104C 'get':48B 'heap':3A,32B,70C 'heap-bas':31B,69C 'interact':24B,95C 'issu':92C 'let':6A 'maco':19B 'malici':8A,103C 'must':100C 'open':41B,52B,101C 'overflow':5A,35B,73C 'photoshop':1A,21B,27B,63C 'requir':93C 'result':77C 'run':10A,56B 'trigger':39B 'user':23B,62B,88C,94C 'user-interact':22B 'victim':50B,99C 'vulner':74C 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Adobe Photoshop Desktop on workstations and open files from outside sources are exposed. The sources do not name affected versions. Systems that do not have Photoshop installed can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobe","high","macos","other","photoshop","userinteraction","windows"],"campaign_type":null,"search_a":"'-113575':14A,17A '-2026':13A,16A 'buffer':4A 'code':11A 'cve':12A,15A 'desktop':2A 'file':9A 'heap':3A 'let':6A 'malici':8A 'overflow':5A 'photoshop':1A 'run':10A","search_b":"'adob':18B,26B 'arbitrari':57B 'attack':46B 'base':33B 'buffer':34B 'code':58B 'craft':43B 'current':61B 'desktop':28B 'file':44B,54B 'get':48B 'heap':32B 'heap-bas':31B 'interact':24B 'maco':19B 'open':41B,52B 'overflow':35B 'photoshop':21B,27B 'run':56B 'trigger':39B 'user':23B,62B 'user-interact':22B 'victim':50B 'window':25B","search_c":"'affect':66C 'arbitrari':79C 'base':71C 'buffer':72C 'code':80C 'context':84C 'could':76C 'current':87C 'desktop':64C 'execut':81C 'exploit':89C 'file':104C 'heap':70C 'heap-bas':69C 'interact':95C 'issu':92C 'malici':103C 'must':100C 'open':101C 'overflow':73C 'photoshop':63C 'requir':93C 'result':77C 'user':88C,94C 'victim':99C 'vulner':74C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:51+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113575","severity":null,"published_at":"2026-11-10T21:18:51+00:00","modified_at":"2026-11-10T21:18:51+00:00","first_seen_at":"2026-11-10T21:46:13+00:00","fetched_at":"2026-11-10T21:46:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-113575:2879","url":"https://www.securityweek.com/adobe-patches-110-vulnerabilities-across-9-products/","severity":null,"published_at":"2026-11-10T21:54:34+00:00","modified_at":"2026-11-10T21:54:34+00:00","first_seen_at":"2026-11-10T21:54:34+00:00","fetched_at":"2026-11-10T21:54:34+00:00","note":"NVD record only; Adobe's Nov 10 2026 Patch Tuesday Photoshop bulletin (APSB26-xxx) not found via search or Adobe pages. SecurityWeek confirms Photoshop was patched in Nov 10 batch, high severity, no known exploitation, priority 3. Affected/fixed versions unknown; nothing verified. Revisit when Adobe bulletin is indexed.","cites":["https://www.securityweek.com/adobe-patches-110-vulnerabilities-across-9-products/"]}],"documents":[{"id":119327,"url":"https://www.securityweek.com/adobe-patches-110-vulnerabilities-across-9-products/","title":"Adobe Patches 110 Vulnerabilities Across 9 Products (SecurityWeek)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}