ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI discloses an Adobe Photoshop PDF JPEG integer overflow that can yield remote code execution.
The Zero Day Initiative published ZDI-26-777, an integer overflow in Adobe Photoshop’s AdobePDFL component during PDF JPEG parsing. A remote attacker can execute arbitrary code if a user opens a malicious file or visits a malicious page. ZDI assigned a CVSS score of 7.8 and CVE-2026-83661. The advisory does not state that the flaw is being exploited.
- Integer overflow in AdobePDFL while parsing JPEG data inside PDFs can lead to remote code execution.
- A user must open a malicious file or visit a malicious page.
- ZDI rated the issue CVSS 7.8 and assigned CVE-2026-83661.
- The advisory does not report active exploitation.
Vulnerabilities mentionedAll →
- CVE-2026-836617.8—Integer overflow in Adobe Photoshop Desktop allows code executionpublished · Adobe Photoshop Desktop
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-83661 | Integer overflow in Adobe Photoshop Desktop allows code execution Adobe Photoshop Desktop is affected by an integer overflow or wraparound (CWE-190) that can lead to arbitrary code execution in the context of the current user. The flaw is triggered only when a victim opens a malicious file, so it is a local, user-interaction attack rather than a remote unauthenticated one. A successful attacker gains high impact on confidentiality, integrity, and availability of that user's session (CVSS 3.1 base score 7.8). Anyone running an affected Photoshop Desktop build who opens untrusted files is at risk; specific version ranges were not included in the source data. It is not listed in CISA KEV and no public proof-of-concept is known. Install the Adobe security update for Photoshop Desktop as soon as it is published for your release, and do not open image or project files from untrusted sources until you are patched. Until then, treat unexpected Photoshop files as untrusted and prefer opening them only in a restricted or non-production account. |
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Photoshop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-83661.
This source does not provide full text. Read it at zerodayinitiative.com.