PHOTOSHOP 2026 · CVE-2026-116003 · Package
FIX → 27.11.1 · 28.0 ✓ verified
Photoshop Desktop has an out-of-bounds write flaw that lets a malicious file make the app write outside its memory bounds. An attacker who gets a victim to open that file can run code as the current user.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Anyone running Photoshop Desktop 2026 (27.11 and earlier) or 2025 (26.11.8 and earlier) on Windows or macOS who opens a crafted file; the flaw is an out-of-bounds write (CWE-787) that runs code as the current user and needs the user to open the file. Designers and teams that receive image or PSD files from outside sources should update first. Those who only open files they made themselves have lower exposure.
Not affected if no-untrusted-files, photoshop-2026-27.11.1-or-later, photoshop-2027
Who cares adobe, desktop, macos, photoshop, windows
26.11.8 or earlierPhotoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
27.11.1, 2027 28.0Upgrade to 27.11.1 · 28.0
27.11.1 or Photoshop 2027 28.0 via Creative Cloud desktop app26.11.8 and earlier stay vulnerable); move to 2026 or 2027