---
id: "CVE-2026-116480"
page: "https://infrastack.ai/live/CVE-2026-116480"
kind: "vulnerability"
aliases: ["CVE-2026-116480"]
title: "Adobe Photoshop: heap buffer overflow lets a malicious file run code"
severity: "high"
cvss: 7.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Photoshop Desktop", "fixed": ["27.11.1", "28.0"], "affected": "2026: <= 27.11; 2025: <= 26.11.8 (Windows, macOS)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["adobe", "desktop", "macos", "malicious-file", "other", "photoshop", "windows"]
not_affected_if: ["no-untrusted-files", "photoshop-2026-27.11.1-or-later", "photoshop-2027"]
published_at: "2026-11-10T21:18:57+00:00"
first_seen_at: "2026-11-10T21:46:14+00:00"
updated_at: "2026-11-10T21:53:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116480", "first_seen_at": "2026-11-10T21:46:14+00:00"}, {"source": "analyst", "url": "https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html", "first_seen_at": "2026-11-10T21:53:39+00:00", "cites": ["https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html"]}]
exploit_sources: []
---

# Adobe Photoshop: heap buffer overflow lets a malicious file run code

Link for people: https://infrastack.ai/live/CVE-2026-116480 (this .md is for agents)

Photoshop Desktop has a heap-based buffer overflow that can be triggered by opening a crafted file. A successful attack runs arbitrary code with the privileges of the current user.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Photoshop Desktop affected 2026: <= 27.11; 2025: <= 26.11.8 (Windows, macOS) fixed 27.11.1, 28.0

## How to check

In Photoshop open Help > About Photoshop (macOS: Photoshop > About Photoshop). Exposed if the version is 27.11 or earlier (Photoshop 2026), or 26.11.8 or earlier (Photoshop 2025), on Windows or macOS. Fixed: 27.11.1 or 28.0.

## Fix

Update Photoshop 2026 to 27.11.1 or move to Photoshop 2027 28.0 via the Creative Cloud desktop app. Photoshop 2025 (26.11.8 and earlier) gets no further update, so upgrade to 2026 or 2027. Admins can deploy through the Admin Console.

## Timeline

- 2026-11-10T21:46:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116480
- 2026-11-10T21:53:39+00:00 analyst https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html — Adobe APSB26-181 (Nov 10 2026, priority 3) read: affected 2026 <=27.11 and 2025 <=26.11.8; fixed 27.11.1 / 28.0; 2025 gets no update. No exploitation known.

## Documents

- [advisory] Adobe Security Bulletin APSB26-181 Photoshop https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html

## From the sources

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_