ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
Merged summary · from the lead articleSummaries by Vani AI
ZDI reports an Adobe Photoshop integer overflow, CVE-2026-95636, that can yield remote code execution.
The Zero Day Initiative published ZDI-26-778, an integer-overflow vulnerability in Adobe Photoshop’s DCM pixel-data parser tracked as CVE-2026-95636. A remote attacker could execute arbitrary code, but the target must open a malicious file or visit a malicious page. ZDI assigned a CVSS score of 7.8. The advisory does not report active exploitation.
Key facts
- Integer overflow occurs while parsing DCM pixel data.
- Successful exploitation can execute arbitrary code on the target.
- The victim must open a malicious file or visit a malicious page.
- ZDI rates the issue CVSS 7.8 under CVE-2026-95636.
- Vendors
- Adobe
- Products
- Adobe PhotoshopAdobePDFL
- Organizations
- Trend Micro Zero Day InitiativeZero Day Initiative
Coverage
oldest first · one row per article · UTC- · 15d ago
ZDI Published AdvisoriesFirst report
ZDI-26-777: Adobe Photoshop AdobePDFL PDF JPEG Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI discloses an Adobe Photoshop PDF JPEG integer overflow that can yield remote code execution.
- · 15d ago
ZDI-26-778: Adobe Photoshop DCM Pixel Data Parsing Integer Overflow Remote Code Execution Vulnerability
ZDI reports an Adobe Photoshop integer overflow, CVE-2026-95636, that can yield remote code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-83661+1 related CVE | Integer overflow in Adobe Photoshop Desktop allows code execution | 7.8 | — |