CVE-2026-27289 is an out-of-bounds read vulnerability in Adobe Photoshop Desktop (version 27.4 and earlier) caused by improper handling of crafted files. This flaw allows an attacker to read memory beyond allocated buffers, which can be leveraged to execute arbitrary code in the context of the current user. Exploitation requires that the victim opens a maliciously crafted file. The vulnerability is rated high severity with a CVSS 3.1 base score of 7.8, reflecting local attack vector with low complexity, no privileges required, but user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation could result in arbitrary code execution with the privileges of the current user, potentially leading to full compromise of the user's environment within the scope of Photoshop Desktop. Confidentiality, integrity, and availability of the affected system could be severely impacted. However, exploitation requires user interaction (opening a malicious file), and no active exploits have been reported in the wild.

As of the current information, no official patch or remediation is available for this vulnerability. Users and administrators should monitor Adobe's official advisories for updates and patches. Until a fix is released, avoid opening files from untrusted or unknown sources to reduce the risk of exploitation.