{"id":"CVE-2026-117546","kind":"vulnerability","aliases":["CVE-2026-117546"],"related":[],"title":"Photoshop Desktop: use-after-free lets a malicious file run code","description":"Photoshop Desktop is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has a use-after-free memory bug. Opening a malicious file can let an attacker run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Photoshop 2026","fixed":["27.11.1"],"affected":"<= 27.11","ecosystem":"vendor"},{"name":"Photoshop 2025","fixed":[],"affected":"<= 26.11.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","desktop","macos","other","photoshop","user-interaction","windows"],"not_affected_if":["file-not-opened"],"how_to_check":"In Photoshop, Help > About Photoshop (Windows) or Photoshop > About Photoshop (macOS). Exposed if Photoshop 2026 is 27.11 or earlier, or Photoshop 2025 is 26.11.8 or earlier (any 2025 version stays exposed). Fixed: 2026 27.11.1, 2027 28.0. Managed fleets: check versions in the Creative Cloud Admin Console.","fix":"Update via the Creative Cloud desktop app to Photoshop 2026 27.11.1 or Photoshop 2027 28.0. Photoshop 2025 gets no update; move to 2026 or 2027.","status":"open","published_at":"2026-11-10T21:18:57+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:47:57+00:00","updated_at":"2026-11-10T21:53:18+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: use-after-free lets a malicious file run code","impact":"high","summary":"Adobe Photoshop Desktop has a use-after-free memory bug. Opening a malicious file can let an attacker run code as the current user.","audience":"everyone","category":"other","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Arbitrary code runs as the current user after opening a file","analyst_note":"Find Adobe's security bulletin for the affected and fixed Photoshop versions; the NVD entry gives none.","how_to_check":"- Open Photoshop and check the installed version under Help > About Photoshop\n- unknown","plain_action":"Update Adobe Photoshop to the latest version and only open image or design files you trust.","product_name":"","needs_analyst":true,"not_affected_if":["file-not-opened"],"who_is_affected":"Anyone running Adobe Photoshop Desktop who opens a crafted file. The sources do not list affected version ranges. Teams that only use Photoshop on managed machines should check with their admins.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4526,"output_tokens":448,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for the affected and fixed Photoshop versions; the NVD entry gives none.","search":"'-117546':15A,18A '-2026':14A,17A '2025':22A '2026':20A 'adob':23B,32B 'affect':60C 'arbitrari':71C 'attack':50B 'bug':42B 'code':12A,52B,72C 'context':76C 'could':68C 'current':55B,79C 'cve':13A,16A 'desktop':2A,24B,34B,58C 'execut':73C 'exploit':81C 'file':10A,46B,96C 'free':6A,40B,65C 'interact':30B,87C 'issu':84C 'let':7A,48B 'maco':25B 'malici':9A,45B,95C 'memori':41B 'must':92C 'open':43B,93C 'photoshop':1A,19A,21A,27B,33B,57C 'requir':85C 'result':69C 'run':11A,51B 'use':4A,38B,63C 'use-after-fre':3A,37B 'user':29B,56B,80C,86C 'user-interact':28B 'victim':91C 'vulner':66C 'window':31B","nicknames":[],"mitigations":[],"who_affected":"Adobe Photoshop 2026 (27.11 and earlier) and Photoshop 2025 (26.11.8 and earlier) on Windows and macOS, per Adobe APSB26-181. Exploitation needs a user to open a crafted file; the CVSS vector is local with user interaction. Adobe is not aware of exploits in the wild. Photoshop 2025 will not get a patch, so those users must upgrade.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:53:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2876},"products":{"at":"2026-11-10T21:53:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2876},"who_affected":{"at":"2026-11-10T21:53:18Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2876}},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Adobe Photoshop to version 2026 (27.11.1) or Photoshop 2027 using the Creative Cloud app, and only open files you trust.","pkeys":["2025","2026","photoshop2025","photoshop2026"],"ptokens":["2025","2026","photoshop"],"labels":["adobe","desktop","high","macos","other","photoshop","userinteraction","windows"],"campaign_type":null,"search_a":"'-117546':15A,18A '-2026':14A,17A '2025':22A '2026':20A 'code':12A 'cve':13A,16A 'desktop':2A 'file':10A 'free':6A 'let':7A 'malici':9A 'photoshop':1A,19A,21A 'run':11A 'use':4A 'use-after-fre':3A","search_b":"'adob':23B,32B 'attack':50B 'bug':42B 'code':52B 'current':55B 'desktop':24B,34B 'file':46B 'free':40B 'interact':30B 'let':48B 'maco':25B 'malici':45B 'memori':41B 'open':43B 'photoshop':27B,33B 'run':51B 'use':38B 'use-after-fre':37B 'user':29B,56B 'user-interact':28B 'window':31B","search_c":"'affect':60C 'arbitrari':71C 'code':72C 'context':76C 'could':68C 'current':79C 'desktop':58C 'execut':73C 'exploit':81C 'file':96C 'free':65C 'interact':87C 'issu':84C 'malici':95C 'must':92C 'open':93C 'photoshop':57C 'requir':85C 'result':69C 'use':63C 'user':80C,86C 'victim':91C 'vulner':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117546","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117546","severity":null,"published_at":"2026-11-10T21:18:57+00:00","modified_at":"2026-11-10T21:18:57+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117546:2876","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","severity":null,"published_at":"2026-11-10T21:53:18+00:00","modified_at":"2026-11-10T21:53:18+00:00","first_seen_at":"2026-11-10T21:53:18+00:00","fetched_at":"2026-11-10T21:53:18+00:00","note":"Adobe APSB26-181 (Nov 10 2026, priority 3) lists CVE-2026-117546 (UAF, CWE-416, CVSS 7.8); no exploits known per Adobe. Web search worked; X not checked (not needed).","cites":["https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html"]}],"documents":[{"id":119311,"url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","title":"Adobe Security Bulletin APSB26-181 Photoshop","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}