CVE-2026-95639: Incorrect Authorization (CWE-863) in Adobe Photoshop

CVE-2026-95639 is an Incorrect Authorization vulnerability in Adobe Photoshop Desktop that could lead to arbitrary code execution in the context of the current user. The vulnerability requires user interaction, as the victim must open a malicious file to trigger exploitation. The vulnerability affects versions up to 27.10 and 26.11.7. The CVSS 3.1 score is 8.6, reflecting high severity with attack vector local, low attack complexity, no privileges required, user interaction required, and scope changed. The impact includes high confidentiality, integrity, and availability impacts.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the current user, potentially leading to full compromise of the user's environment within the scope of Photoshop. The vulnerability requires user interaction, limiting remote exploitation without user involvement. The changed scope indicates that the impact may extend beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should exercise caution when opening files from untrusted sources. Monitor Adobe's official channels for updates and apply patches once available.