{"id":"CVE-2026-117547","kind":"vulnerability","aliases":["CVE-2026-117547"],"related":[],"title":"Photoshop Desktop: out-of-bounds write lets a malicious file run code","description":"Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has an out-of-bounds write flaw. Opening a crafted file can let an attacker run code as the current user.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Photoshop 2026","fixed":["27.11.1"],"affected":"<= 27.11","ecosystem":"vendor"},{"name":"Photoshop 2025","fixed":[],"affected":"<= 26.11.8","ecosystem":"vendor"}],"ecosystems":[],"tags":["adobe","creative-desktop","macos","other","photoshop","windows"],"not_affected_if":["photoshop-2026-27.11.1-or-later","photoshop-2027"],"how_to_check":"In Photoshop open Help > About Photoshop (macOS: Photoshop > About Photoshop). Exposed if Photoshop 2026 is 27.11 or earlier, or Photoshop 2025 is 26.11.8 or earlier. Managed fleets: check the installed version in the Creative Cloud Admin Console.","fix":"Update Photoshop 2026 to 27.11.1 or Photoshop 2027 to 28.0 via the Creative Cloud desktop app. Photoshop 2025 gets no update; move to 2026 27.11.1 or 2027 28.0.","status":"open","published_at":"2026-11-10T21:18:57+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:47:56+00:00","updated_at":"2026-11-10T21:53:20+00:00","category":"other","confidence":0.9,"triage":{"at":"2026-11-10T21:47:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: out-of-bounds write lets a malicious file run code","impact":"high","summary":"Adobe Photoshop Desktop has an out-of-bounds write flaw. Opening a crafted file can let an attacker run code as the current user.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","creative-desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Code runs as the current user after opening a malicious file","analyst_note":"Find Adobe's security bulletin for affected and fixed Photoshop versions; check https://nvd.nist.gov/vuln/detail/CVE-2026-117547.","how_to_check":"- unknown","plain_action":"","product_name":"Adobe Photoshop Desktop","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Anyone who opens files in Adobe Photoshop Desktop may be exposed, since the flaw is triggered by opening a malicious file. The sources do not list affected or fixed versions, so unknown.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":4530,"output_tokens":448,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Adobe's security bulletin for affected and fixed Photoshop versions; check https://nvd.nist.gov/vuln/detail/CVE-2026-117547.","search":"'-117547':16A,19A '-2026':15A,18A '2025':23A '2026':21A 'adob':24B,32B 'affect':60C 'arbitrari':73C 'attack':50B 'bound':6A,40B,66C 'code':13A,52B,74C 'context':78C 'could':70C 'craft':45B 'creativ':26B 'creative-desktop':25B 'current':55B,81C 'cve':14A,17A 'desktop':2A,27B,34B,58C 'execut':75C 'exploit':83C 'file':11A,46B,98C 'flaw':42B 'interact':89C 'issu':86C 'let':8A,48B 'maco':28B 'malici':10A,97C 'must':94C 'open':43B,95C 'out-of-bound':3A,37B,63C 'photoshop':1A,20A,22A,30B,33B,57C 'requir':87C 'result':71C 'run':12A,51B 'user':56B,82C,88C 'victim':93C 'vulner':68C 'window':31B 'write':7A,41B,67C","nicknames":[],"mitigations":[],"who_affected":"Anyone running Adobe Photoshop 2026 (27.11 and earlier) or Photoshop 2025 (26.11.8 and earlier) on Windows or macOS is exposed. The flaw is triggered when the user opens a malicious file, and code then runs as that user. Teams that handle image files from outside (designers, content or marketing staff) should update first; machines without Photoshop can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:53:20Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2875},"products":{"at":"2026-11-10T21:53:20Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2875},"how_to_check":{"at":"2026-11-10T21:53:20Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2875},"who_affected":{"at":"2026-11-10T21:53:20Z","by":"analyst","doc":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","run_id":2875}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["2025","2026","photoshop2025","photoshop2026"],"ptokens":["2025","2026","photoshop"],"labels":["adobe","creativedesktop","high","macos","other","photoshop","windows"],"campaign_type":null,"search_a":"'-117547':16A,19A '-2026':15A,18A '2025':23A '2026':21A 'bound':6A 'code':13A 'cve':14A,17A 'desktop':2A 'file':11A 'let':8A 'malici':10A 'out-of-bound':3A 'photoshop':1A,20A,22A 'run':12A 'write':7A","search_b":"'adob':24B,32B 'attack':50B 'bound':40B 'code':52B 'craft':45B 'creativ':26B 'creative-desktop':25B 'current':55B 'desktop':27B,34B 'file':46B 'flaw':42B 'let':48B 'maco':28B 'open':43B 'out-of-bound':37B 'photoshop':30B,33B 'run':51B 'user':56B 'window':31B 'write':41B","search_c":"'affect':60C 'arbitrari':73C 'bound':66C 'code':74C 'context':78C 'could':70C 'current':81C 'desktop':58C 'execut':75C 'exploit':83C 'file':98C 'interact':89C 'issu':86C 'malici':97C 'must':94C 'open':95C 'out-of-bound':63C 'photoshop':57C 'requir':87C 'result':71C 'user':82C,88C 'victim':93C 'vulner':68C 'write':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117547","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117547","severity":null,"published_at":"2026-11-10T21:18:57+00:00","modified_at":"2026-11-10T21:18:57+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117547:2875","url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","severity":null,"published_at":"2026-11-10T21:53:20+00:00","modified_at":"2026-11-10T21:53:20+00:00","first_seen_at":"2026-11-10T21:53:20+00:00","fetched_at":"2026-11-10T21:53:20+00:00","note":"Adobe APSB26-181 (Nov 10 2026) lists this CVE: CWE-787, CVSS 7.8, no known exploits. Affected/fixed versions read from the bulletin. X/social not checked; no PoC found.","cites":["https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html"]}],"documents":[{"id":119311,"url":"https://www.adobe.com/trust/security/products/photoshop/apsb26-181.html","title":"Adobe Security Bulletin APSB26-181 Photoshop","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}