{"id":"CVE-2026-118200","kind":"vulnerability","aliases":["CVE-2026-118200"],"related":[],"title":"Photoshop Desktop: out-of-bounds read can leak sensitive memory from a file","description":"Photoshop Desktop is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","summary":"Adobe Photoshop Desktop has an out-of-bounds read flaw. A victim who opens a malicious file can have sensitive memory contents disclosed to an attacker.","severity":"medium","cvss":5.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["adobe","desktop","other","photoshop"],"not_affected_if":["no-photoshop-installed"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","triaged_at":"2026-11-10T21:48:30+00:00","updated_at":"2026-11-10T21:48:30+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T21:48:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Photoshop Desktop: out-of-bounds read can leak sensitive memory from a file","impact":"low","summary":"Adobe Photoshop Desktop has an out-of-bounds read flaw. A victim who opens a malicious file can have sensitive memory contents disclosed to an attacker.","audience":"businesses","category":"other","nicknames":[],"who_cares":["photoshop","adobe","desktop"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"sensitive memory contents disclosed to an attacker","analyst_note":"Check Adobe's security bulletin for affected and fixed Photoshop Desktop versions and the update to install.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-photoshop-installed"],"who_is_affected":"Teams that run Photoshop Desktop on workstations and open files from outside sources are the ones exposed. The sources do not say which Photoshop versions are affected or which are fixed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000661,"input_tokens":4555,"output_tokens":410,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118200':17A,20A '-2026':16A,19A 'adob':21B,25B 'affect':55C 'attack':51B,73C 'bound':6A,33B,61C 'content':47B 'could':65C,74C 'cve':15A,18A 'desktop':2A,22B,27B,53C 'disclos':48B,79C 'disclosur':68C 'exploit':82C 'file':14A,42B,97C 'flaw':35B 'inform':81C 'interact':88C 'issu':85C 'lead':66C 'leak':9A 'leverag':75C 'malici':41B,96C 'memori':11A,46B,71C 'must':93C 'open':39B,94C 'out-of-bound':3A,30B,58C 'photoshop':1A,24B,26B,52C 'read':7A,34B,62C 'requir':86C 'sensit':10A,45B,70C,80C 'user':87C 'victim':37B,92C 'vulner':63C,77C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Photoshop Desktop on workstations and open files from outside sources are the ones exposed. The sources do not say which Photoshop versions are affected or which are fixed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["adobe","desktop","medium","other","photoshop"],"campaign_type":null,"search_a":"'-118200':17A,20A '-2026':16A,19A 'bound':6A 'cve':15A,18A 'desktop':2A 'file':14A 'leak':9A 'memori':11A 'out-of-bound':3A 'photoshop':1A 'read':7A 'sensit':10A","search_b":"'adob':21B,25B 'attack':51B 'bound':33B 'content':47B 'desktop':22B,27B 'disclos':48B 'file':42B 'flaw':35B 'malici':41B 'memori':46B 'open':39B 'out-of-bound':30B 'photoshop':24B,26B 'read':34B 'sensit':45B 'victim':37B","search_c":"'affect':55C 'attack':73C 'bound':61C 'could':65C,74C 'desktop':53C 'disclos':79C 'disclosur':68C 'exploit':82C 'file':97C 'inform':81C 'interact':88C 'issu':85C 'lead':66C 'leverag':75C 'malici':96C 'memori':71C 'must':93C 'open':94C 'out-of-bound':58C 'photoshop':52C 'read':62C 'requir':86C 'sensit':70C,80C 'user':87C 'victim':92C 'vulner':63C,77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T21:18:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"psirt@adobe.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118200","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118200","severity":null,"published_at":"2026-11-10T21:18:58+00:00","modified_at":"2026-11-10T21:18:58+00:00","first_seen_at":"2026-11-10T21:46:14+00:00","fetched_at":"2026-11-10T21:46:14+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}