ZDI discloses three CVSS 7.8 integer overflow remote code execution flaws in Adobe Photoshop DCM parsing (CVE-2026-75771, CVE-2026-75862, CVE-2026-75863)

On 2026-09-10, the Zero Day Initiative published three advisories (ZDI-26-677, ZDI-26-678, ZDI-26-679), each describing a distinct CVSS 7.8 integer overflow that allows remote code execution when Adobe Photoshop parses DCM files, JPEG data in DCM images, or…

The Zero Day Initiative published three separate advisories on 2026-09-10 (2026-09-10T05:00:00.000Z) covering integer overflow remote code execution vulnerabilities in Adobe Photoshop's parsing of DCM content. Each advisory targets a different parsing path: ZDI-26-678 (CVE-2026-75863) covers an integer overflow while parsing DCM files; ZDI-26-679 (CVE-2026-75862) covers an integer overflow while parsing JPEG data in DCM images; and ZDI-26-677 (CVE-2026-75771) covers an integer overflow while parsing JPEG-LS images in DCM. All three vulnerabilities are rated CVSS 7.8 and could allow a remote attacker to execute arbitrary code. Exploitation of all three requires user interaction: the target must visit a malicious page or open a malicious file. ZDI reports no in-the-wild exploitation for any of the three flaws. The three reports are mutually consistent; there are no discrepancies between them.