CVE-2026-104348: Heap-based Buffer Overflow (CWE-122) in Adobe Photoshop

CVE-2026-104348 is a heap-based buffer overflow vulnerability (CWE-122) in Adobe Photoshop Desktop. Successful exploitation could lead to arbitrary code execution in the context of the current user. The attack vector requires local access with user interaction, as the victim must open a crafted malicious file. The vulnerability affects Adobe Photoshop versions up to and including 27.10 and 26.11.7. There is no indication of known exploits in the wild or available patches at this time.

If exploited, an attacker could execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the affected system under that user context. The requirement for user interaction reduces the risk somewhat but does not eliminate it. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when opening files from untrusted sources. Monitor Adobe's security advisories for updates regarding patches or workarounds.