{"id":"CVE-2026-116003","kind":"vulnerability","aliases":["CVE-2026-116003"],"related":[],"title":"Adobe Photoshop Desktop: crafted file opens a memory write that runs code","description":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Photoshop Desktop has an out-of-bounds write flaw that lets a malicious file make the app write outside its memory bounds. An attacker who gets a victim to open that file can run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Photoshop 2026","fixed":["27.11.1"],"affected":"<= 27.11","ecosystem":"vendor"},{"name":"Photoshop 2025","fixed":[],"affected":"<= 26.11.8","ecosystem":"vendor"},{"name":"Photoshop 2027","fixed":["28.0"],"affected":"none","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","package","photoshop","windows"],"not_affected_if":["no-untrusted-files","photoshop-2026-27.11.1-or-later","photoshop-2027"],"how_to_check":"In Photoshop open Help > About Photoshop (Windows and macOS). Vulnerable: Photoshop 2026 27.11 or earlier, Photoshop 2025 26.11.8 or earlier. Fixed: 2026 27.11.1, 2027 28.0. Managed fleets: check Creative Cloud versions in the Admin Console.","fix":"Update to Photoshop 2026 27.11.1 or Photoshop 2027 28.0 via Creative Cloud desktop app. Photoshop 2025 gets no further update (26.11.8 and earlier stay vulnerable); move to 2026 or 2027.","status":"open","published_at":"2026-11-10T21:18:56+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:47:59+00:00","updated_at":"2026-11-10T21:53:19+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-11-10T21:47:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Adobe Photoshop Desktop: crafted file opens a memory write that runs code","impact":"high","summary":"Photoshop Desktop has an out-of-bounds write flaw that lets a malicious file make the app write outside its memory bounds. An attacker who gets a victim to open that file can run code as the current user.","audience":"businesses","category":"package","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a malicious file","analyst_note":"Find Adobe's bulletin for Photoshop Desktop to get affected and fixed versions; the NVD entry gives none.","how_to_check":"- Open Photoshop and check the version under Help > About Photoshop, comparing it against the fixed versions in Adobe's bulletin\n- Note that the sources do not name affected version ranges","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Anyone running Photoshop Desktop who opens files from untrusted sources is exposed, because the flaw is triggered by opening a malicious file. The sources do not list affected versions, so the exact range is unknown. Teams that never open untrusted image files in Photoshop have lower exposure.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4530,"output_tokens":511,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Adobe's bulletin for Photoshop Desktop to get affected and fixed versions; the NVD entry gives none.","search":"'-116003':15A,18A '-2026':14A,17A '2025':22A '2026':20A '2027':24A 'adob':1A,25B 'affect':74C 'app':48B 'arbitrari':87C 'attack':55B 'bound':38B,53B,80C 'code':12A,66B,88C 'context':92C 'could':84C 'craft':4A 'current':69B,95C 'cve':13A,16A 'desktop':3A,26B,32B,72C 'execut':89C 'exploit':97C 'file':5A,45B,63B,112C 'flaw':40B 'get':57B 'interact':103C 'issu':100C 'let':42B 'maco':27B 'make':46B 'malici':44B,111C 'memori':8A,52B 'must':108C 'open':6A,61B,109C 'out-of-bound':35B,77C 'outsid':50B 'packag':28B 'photoshop':2A,19A,21A,23A,29B,31B,71C 'requir':101C 'result':85C 'run':11A,65B 'user':70B,96C,102C 'victim':59B,107C 'vulner':82C 'window':30B 'write':9A,39B,49B,81C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Photoshop Desktop 2026 (27.11 and earlier) or 2025 (26.11.8 and earlier) on Windows or macOS who opens a crafted file; the flaw is an out-of-bounds write (CWE-787) that runs code as the current user and needs the user to open the file. Designers and teams that receive image or PSD files from outside sources should update first. Those who only open files they made themselves have lower exposure.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:53:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2878},"products":{"at":"2026-11-10T21:53:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2878},"how_to_check":{"at":"2026-11-10T21:53:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2878},"who_affected":{"at":"2026-11-10T21:53:19Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2878}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["2025","2026","2027","photoshop2025","photoshop2026","photoshop2027"],"ptokens":["2025","2026","2027","photoshop"],"labels":["adobe","desktop","high","macos","package","photoshop","windows"],"campaign_type":null,"search_a":"'-116003':15A,18A '-2026':14A,17A '2025':22A '2026':20A '2027':24A 'adob':1A 'code':12A 'craft':4A 'cve':13A,16A 'desktop':3A 'file':5A 'memori':8A 'open':6A 'photoshop':2A,19A,21A,23A 'run':11A 'write':9A","search_b":"'adob':25B 'app':48B 'attack':55B 'bound':38B,53B 'code':66B 'current':69B 'desktop':26B,32B 'file':45B,63B 'flaw':40B 'get':57B 'let':42B 'maco':27B 'make':46B 'malici':44B 'memori':52B 'open':61B 'out-of-bound':35B 'outsid':50B 'packag':28B 'photoshop':29B,31B 'run':65B 'user':70B 'victim':59B 'window':30B 'write':39B,49B","search_c":"'affect':74C 'arbitrari':87C 'bound':80C 'code':88C 'context':92C 'could':84C 'current':95C 'desktop':72C 'execut':89C 'exploit':97C 'file':112C 'interact':103C 'issu':100C 'malici':111C 'must':108C 'open':109C 'out-of-bound':77C 'photoshop':71C 'requir':101C 'result':85C 'user':96C,102C 'victim':107C 'vulner':82C 'write':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116003","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116003","severity":null,"published_at":"2026-11-10T21:18:56+00:00","modified_at":"2026-11-10T21:18:57+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116003:2878","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","severity":null,"published_at":"2026-11-10T21:53:19+00:00","modified_at":"2026-11-10T21:53:19+00:00","first_seen_at":"2026-11-10T21:53:19+00:00","fetched_at":"2026-11-10T21:53:19+00:00","note":"Read Adobe APSB26-181 (Nov 10 2026): affected and fixed versions, not exploited per Adobe. No PoC/discussion searched (routine B).","cites":["https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html"]}],"documents":[{"id":119311,"url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","title":"Adobe Security Bulletin APSB26-181 Photoshop","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}