ZDI-26-677: Adobe Photoshop DCM JPEG-LS Image Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI disclosed CVE-2026-75771, an integer overflow in Adobe Photoshop's DCM JPEG-LS image parsing that enables remote code execution with user interaction.
The Zero Day Initiative published advisory ZDI-26-677 for an integer overflow in Adobe Photoshop's parsing of DCM JPEG-LS images. A remote attacker could execute arbitrary code if the target opens a malicious file or visits a malicious page. ZDI assigned a CVSS rating of 7.8. No exploitation is reported.
- CVE-2026-75771 assigned; CVSS 7.8
- User interaction required: malicious page visit or file open
- Integer overflow in DCM JPEG-LS parsing leads to RCE
- CVEs
- CVE-2026-75771
- Vendors
- AdobeZero Day Initiative
- Products
- Adobe Photoshop
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75771 | Integer Overflow Leading to Arbitrary Code Execution in Adobe Photoshop Desktop | 7.8 | <1% |
From the original article
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.