ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI reports an Adobe Photoshop integer overflow, CVE-2026-95636, that can yield remote code execution.
The Zero Day Initiative published ZDI-26-778, an integer-overflow vulnerability in Adobe Photoshop’s DCM pixel-data parser tracked as CVE-2026-95636. A remote attacker could execute arbitrary code, but the target must open a malicious file or visit a malicious page. ZDI assigned a CVSS score of 7.8. The advisory does not report active exploitation.
- Integer overflow occurs while parsing DCM pixel data.
- Successful exploitation can execute arbitrary code on the target.
- The victim must open a malicious file or visit a malicious page.
- ZDI rates the issue CVSS 7.8 under CVE-2026-95636.
Vulnerabilities mentionedAll →
- CVE-2026-956367.8—Integer overflow in Adobe Photoshop Desktop enables code executionpublished · Adobe Photoshop Desktop
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-95636 | Integer overflow in Adobe Photoshop Desktop enables code execution Adobe Photoshop Desktop is affected by an integer overflow or wraparound (CWE-190) that can lead to arbitrary code execution in the context of the current user. An attacker must convince a victim to open a malicious file; the issue is local, requires user interaction, and needs no prior privileges. Successful exploitation could give the attacker the same access as the logged-in user, including reading or changing files and running programs. Photoshop Desktop users who open untrusted documents are the population at risk; the advisory data does not name specific version ranges. It is not listed in CISA's Known Exploited Vulnerabilities catalog, and no public proof-of-concept is known. Install Adobe's security update for Photoshop Desktop as soon as it is available through the Creative Cloud app or Adobe's security bulletin, and confirm the installed build is no longer listed as affected. Until then, do not open Photoshop files from untrusted sources, and treat unexpected PSD or related documents as untrusted. |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-95636.
This source does not provide full text. Read it at zerodayinitiative.com.