{"id":"CVE-2026-115345","kind":"vulnerability","aliases":["CVE-2026-115345"],"related":[],"title":"Photoshop Desktop: out-of-bounds read can leak sensitive memory from a file","description":"Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has an out-of-bounds read flaw. A victim who opens a malicious file can let an attacker disclose sensitive memory contents.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","desktop","other","photoshop"],"not_affected_if":["no-untrusted-files"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:56+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:48:33+00:00","updated_at":"2026-11-10T21:48:33+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T21:48:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: out-of-bounds read can leak sensitive memory from a file","impact":"low","summary":"Adobe Photoshop Desktop has an out-of-bounds read flaw. A victim who opens a malicious file can let an attacker disclose sensitive memory contents.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker reads sensitive process memory after victim opens file","analyst_note":"Find affected Photoshop versions and the Adobe bulletin with the fixed release; NVD entry lacks CPE ranges.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Teams that run Adobe Photoshop Desktop and open files from untrusted sources are the ones exposed, since the victim must open a malicious file. The sources do not name affected versions or a fix, so unknown.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000669,"input_tokens":4555,"output_tokens":426,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115345':17A,20A '-2026':16A,19A 'adob':21B,25B 'affect':54C 'attack':46B,72C 'bound':6A,33B,60C 'content':50B 'could':64C,73C 'cve':15A,18A 'desktop':2A,22B,27B,52C 'disclos':47B,78C 'disclosur':67C 'exploit':81C 'file':14A,42B,96C 'flaw':35B 'inform':80C 'interact':87C 'issu':84C 'lead':65C 'leak':9A 'let':44B 'leverag':74C 'malici':41B,95C 'memori':11A,49B,70C 'must':92C 'open':39B,93C 'out-of-bound':3A,30B,57C 'photoshop':1A,24B,26B,51C 'read':7A,34B,61C 'requir':85C 'sensit':10A,48B,69C,79C 'user':86C 'victim':37B,91C 'vulner':62C,76C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Adobe Photoshop Desktop and open files from untrusted sources are the ones exposed, since the victim must open a malicious file. The sources do not name affected versions or a fix, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobe","desktop","medium","other","photoshop"],"campaign_type":null,"search_a":"'-115345':17A,20A '-2026':16A,19A 'bound':6A 'cve':15A,18A 'desktop':2A 'file':14A 'leak':9A 'memori':11A 'out-of-bound':3A 'photoshop':1A 'read':7A 'sensit':10A","search_b":"'adob':21B,25B 'attack':46B 'bound':33B 'content':50B 'desktop':22B,27B 'disclos':47B 'file':42B 'flaw':35B 'let':44B 'malici':41B 'memori':49B 'open':39B 'out-of-bound':30B 'photoshop':24B,26B 'read':34B 'sensit':48B 'victim':37B","search_c":"'affect':54C 'attack':72C 'bound':60C 'could':64C,73C 'desktop':52C 'disclos':78C 'disclosur':67C 'exploit':81C 'file':96C 'inform':80C 'interact':87C 'issu':84C 'lead':65C 'leverag':74C 'malici':95C 'memori':70C 'must':92C 'open':93C 'out-of-bound':57C 'photoshop':51C 'read':61C 'requir':85C 'sensit':69C,79C 'user':86C 'victim':91C 'vulner':62C,76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115345","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115345","severity":null,"published_at":"2026-11-10T21:18:56+00:00","modified_at":"2026-11-10T21:18:56+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}