CVE-2026-27289 is an out-of-bounds read vulnerability (CWE-125) in Adobe Photoshop Desktop (versions 27.4 and earlier). The issue occurs during the parsing of crafted files, leading to reading past the end of an allocated memory structure. Successful exploitation requires the victim to open a malicious file, which could result in arbitrary code execution under the current user's context. The vulnerability has a CVSS 3.1 base score of 7.8, indicating high severity. No patch or official remediation level has been disclosed by Adobe as of the publication date.

If exploited, this vulnerability could allow an attacker to execute arbitrary code with the privileges of the user running Photoshop Desktop. This could lead to full compromise of the user's environment depending on their privileges. Exploitation requires user interaction by opening a malicious file. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the Adobe vendor advisory for current remediation guidance. Until a patch is available, users should avoid opening files from untrusted or unknown sources. Monitor Adobe's official security advisories for updates regarding fixes or mitigations.