CVE-2026-75631

An out-of-bounds write vulnerability (CWE-787) in Adobe Photoshop Desktop can corrupt memory in a way that allows arbitrary code execution on the victim's machine. The flaw is triggered when a user opens a maliciously crafted file in Photoshop, which is why user interaction is required for exploitation. A successful attacker gains the ability to run code with the privileges of the current user, potentially enabling malware installation or theft of data accessible to that account. Anyone running the affected Photoshop Desktop build who opens untrusted files is exposed; the available data does not specify which version ranges are affected. There is currently no known exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates only a 0.2% probability of exploitation within 30 days.

What to do: Check Adobe's security bulletin for CVE-2026-75631 and update Photoshop Desktop to the patched release it specifies, since the available data does not include fixed version numbers. Until patched, avoid opening image or project files from untrusted or unexpected sources, as exploitation requires opening a malicious file. Endpoints used to review untrusted imagery (e.g., mailroom or design intake workstations) should be prioritized for the update.