CVE-2026-95635
7.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-415
Impact
Attackers can execute arbitrary code with the local user's privileges. Exploitation requires convincing a user to open a crafted malicious file in Photoshop.
Root cause
A double free vulnerability triggers memory corruption during file processing.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Update Photoshop Desktop to the patched version referenced in Adobe advisory apsb26-158. Block or warn on untrusted Photoshop file formats at email and web gateways until clients are patched.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Photoshop Desktop is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file.