CVE-2026-96523: Adobe Photoshop out-of-bounds write leading to arbitrary code execution

CVE-2026-96523 · Severity: high · CVSS 7.8 · Published 2026-10-13

Adobe Photoshop, a professional image editing application used by designers and content creators, contains multiple out-of-bounds write vulnerabilities that could allow attackers to execute arbitrary code on a user's computer. An attacker could exploit these flaws by crafting a malicious file and tricking a victim into opening it in Photoshop, gaining the ability to install malware, steal data, or take control of the system.

Technologies: Adobe Photoshop, Apple macOS, Microsoft Windows. Vendors: Adobe, Apple, Microsoft.

Quick answers

Is CVE-2026-96523 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-96523 being exploited in the wild.
How severe is CVE-2026-96523?
High severity, with a CVSS score of 7.8, published 13 October 2026.
Which products and versions are affected?
Adobe Photoshop 2026 27.10 and earlier, 2025 26.11.7 and earlier.
Is there a fix for CVE-2026-96523?
Yes: fixed in Photoshop 2026 27.11, Photoshop 2025 26.11.8. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96523 attacked?
It is attacked with local access, in a web application.
Am I affected by CVE-2026-96523?
Check whether you run Adobe Photoshop, Apple macOS or Microsoft Windows at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Photoshop 2026 27.11, Photoshop 2025 26.11.8

Technical details

CVE-2026-96523 is an out-of-bounds write vulnerability (CWE-787) in Adobe Photoshop that leads to arbitrary code execution. Exploitation requires local file access and user interaction to open a malicious file; the attack executes in the context of the current user with no privilege escalation required. The bulletin indicates this is one of multiple similar vulnerabilities (at least 15 CVEs total) affecting Photoshop versions 2026 27.10 and earlier, and 2025 26.11.7 and earlier, all rated high severity with CVSS 7.8.

Affected products

  • Adobe Photoshop 2026 27.10 and earlier, 2025 26.11.7 and earlier

Timeline

  • 2026-10-13: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.