Is CVE-2026-95637 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95637 being exploited in the wild.

How severe is CVE-2026-95637?

High severity, with a CVSS score of 7.8, published 13 October 2026.

Which products and versions are affected?

Adobe Photoshop 2025 26.11.7 and earlier; Adobe Photoshop 2026 27.10 and earlier.

Is there a fix for CVE-2026-95637?

Yes: fixed in Photoshop 2026 27.11, Photoshop 2025 26.11.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-95637 attacked?

It is attacked with local access, in a web application.

Am I affected by CVE-2026-95637?

Check whether you run Adobe Photoshop 2025 or Adobe Photoshop 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95637: Adobe Photoshop out-of-bounds write in file handling

CVE-2026-95637 · Severity: high · CVSS 7.8 · Published 2026-10-13

Adobe Photoshop, a professional image editing application, contains multiple memory corruption vulnerabilities in file parsing that could allow an attacker to execute arbitrary code. An attacker would need to trick a user into opening a malicious image file, after which the attacker's code would run with the user's privileges and could steal data or compromise the system.

Technologies: Adobe Photoshop 2025, Adobe Photoshop 2026. Vendors: Adobe.

Quick answers

Is CVE-2026-95637 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95637 being exploited in the wild.
How severe is CVE-2026-95637?: High severity, with a CVSS score of 7.8, published 13 October 2026.
Which products and versions are affected?: Adobe Photoshop 2025 26.11.7 and earlier; Adobe Photoshop 2026 27.10 and earlier.
Is there a fix for CVE-2026-95637?: Yes: fixed in Photoshop 2026 27.11, Photoshop 2025 26.11.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-95637 attacked?: It is attacked with local access, in a web application.
Am I affected by CVE-2026-95637?: Check whether you run Adobe Photoshop 2025 or Adobe Photoshop 2026 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Photoshop 2026 27.11, Photoshop 2025 26.11.8

Technical details

CVE-2026-95637 is an out-of-bounds write vulnerability (CWE-787) in Photoshop's file handling code. Exploitation requires user interaction—a victim must open a malicious file—but no special privileges are needed. The bulletin details 16 related memory corruption flaws including buffer overflows, integer overflows, and double-free bugs, all triggered by opening crafted files and leading to code execution in the user's context.

Affected products

Adobe Photoshop 2026 27.10 and earlier
Adobe Photoshop 2025 26.11.7 and earlier

Timeline

2026-10-13: disclosed
2026-10-13: patched

References

https://www.adobe.com/trust/security/products/photoshop/apsb26-158.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.