CVE-2026-95638: Heap-based Buffer Overflow (CWE-122) in Adobe Photoshop

CVE-2026-95638 is a heap-based buffer overflow vulnerability in Adobe Photoshop Desktop. This vulnerability allows an attacker to execute arbitrary code in the context of the current user if the victim opens a specially crafted malicious file. The vulnerability affects Photoshop versions up to and including 27.10 and 26.11.7. The CVSS v3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. There is no indication of known exploits in the wild or vendor-provided patches at this time.

Successful exploitation can lead to arbitrary code execution with the privileges of the current user, potentially compromising confidentiality, integrity, and availability of the affected system. User interaction is required, limiting the attack vector to scenarios where a user opens a malicious file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid opening files from untrusted sources and apply standard security best practices to limit exposure.