{"id":"CVE-2026-118198","kind":"vulnerability","aliases":["CVE-2026-118198"],"related":[],"title":"Photoshop Desktop: NULL pointer dereference lets a malicious file crash the app","description":"Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Photoshop Desktop has a NULL pointer dereference that a malicious file can trigger. An attacker can crash the application, causing a denial of service.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","desktop","other","photoshop"],"not_affected_if":["no-untrusted-files"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:48:31+00:00","updated_at":"2026-11-10T21:48:31+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T21:48:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: NULL pointer dereference lets a malicious file crash the app","impact":"low","summary":"Photoshop Desktop has a NULL pointer dereference that a malicious file can trigger. An attacker can crash the application, causing a denial of service.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"application crashes and stops until restarted","analyst_note":"Check Adobe's security bulletin for affected and fixed Photoshop Desktop versions; the NVD entry gives none.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-untrusted-files"],"who_is_affected":"Teams that run Adobe Photoshop Desktop and open files from untrusted sources are exposed. The sources do not say which Photoshop versions are affected or which vendor fix applies.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":4557,"output_tokens":399,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118198':15A,18A '-2026':14A,17A 'adob':19B 'affect':50C 'app':12A 'applic':41B,62C,76C 'attack':37B,68C 'caus':42B 'condit':84C 'could':58C,69C 'crash':10A,39B,74C 'cve':13A,16A 'denial':44B,64C,81C 'denial-of-servic':63C,80C 'derefer':5A,29B,55C 'desktop':2A,20B,24B,48C 'exploit':70C,85C 'file':9A,33B,100C 'interact':91C 'issu':88C 'lead':77C 'let':6A 'malici':8A,32B,99C 'must':96C 'null':3A,27B,53C 'open':97C 'photoshop':1A,22B,23B,47C 'pointer':4A,28B,54C 'requir':89C 'result':59C 'servic':46B,66C,83C 'trigger':35B 'user':90C 'victim':95C 'vulner':56C,72C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Adobe Photoshop Desktop and open files from untrusted sources are exposed. The sources do not say which Photoshop versions are affected or which vendor fix applies.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobe","desktop","medium","other","photoshop"],"campaign_type":null,"search_a":"'-118198':15A,18A '-2026':14A,17A 'app':12A 'crash':10A 'cve':13A,16A 'derefer':5A 'desktop':2A 'file':9A 'let':6A 'malici':8A 'null':3A 'photoshop':1A 'pointer':4A","search_b":"'adob':19B 'applic':41B 'attack':37B 'caus':42B 'crash':39B 'denial':44B 'derefer':29B 'desktop':20B,24B 'file':33B 'malici':32B 'null':27B 'photoshop':22B,23B 'pointer':28B 'servic':46B 'trigger':35B","search_c":"'affect':50C 'applic':62C,76C 'attack':68C 'condit':84C 'could':58C,69C 'crash':74C 'denial':64C,81C 'denial-of-servic':63C,80C 'derefer':55C 'desktop':48C 'exploit':70C,85C 'file':100C 'interact':91C 'issu':88C 'lead':77C 'malici':99C 'must':96C 'null':53C 'open':97C 'photoshop':47C 'pointer':54C 'requir':89C 'result':59C 'servic':66C,83C 'user':90C 'victim':95C 'vulner':56C,72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118198","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118198","severity":null,"published_at":"2026-11-10T21:18:58+00:00","modified_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}